GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: skaffold, grafana-alloy-fips, apko, kubevela-fips, grafana-fips, gitlab-runner, external-secrets-operator, chainctl-fips, trufflehog-fips, mapotf, grype-db, trivy-operator, crossplane-fips, pulumi-language-dotnet, grafana, trivy, amazon-ssm-agent, cerbos-fips, witnes...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, syft, argo-events, pulumi, argo-cd, goreleaser, flux-source-controller, wolfictl, zot, scorecard, rancher-fleet, trufflehog, kaniko, zarf, melange, gitlab-runner, flux, osv-scanner, pulumi-language-java, nfpm, flux-image-automation-controller,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, syft, argo-events, pulumi, argo-cd, goreleaser, flux-source-controller, wolfictl, zot, scorecard, rancher-fleet, trufflehog, kaniko, zarf, melange, gitlab-runner, flux, osv-scanner, pulumi-language-java, nfpm, flux-image-automation-controller,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: skaffold, grafana-alloy-fips, apko, kubevela-fips, grafana-fips, gitlab-runner, external-secrets-operator, chainctl-fips, trufflehog-fips, mapotf, grype-db, trivy-operator, crossplane-fips, pulumi-language-dotnet, grafana, trivy, amazon-ssm-agent, cerbos-fips, witnes...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, tflint, aactl, zot, goreleaser, flux-source-controller, ko, policy-controller, zarf, tkn, gitlab-runner, ratify, bom, neuvector-sigstore-interface, buildkitd, docker-compose, skaffold, vexctl, gh, gitsign, trivy-operator, falcoctl, rekor,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: docker, skaffold, kyverno-policy-reporter-plugins-kyverno-fips, gitlab-runner, tflint-fips, chainctl-fips, policy-controller-fips, trivy-operator, crossplane-fips, chainloop-control-plane, trivy, tkn, docker-fips, docker-compose-fips, chainloop-control-plane-fips,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: skaffold, grafana-alloy-fips, apko, kubevela-fips, grafana-fips, gitlab-runner, external-secrets-operator, chainctl-fips, trufflehog-fips, mapotf, commercial-chainloop-cli, grype-db, trivy-operator, crossplane-fips, pulumi-language-dotnet, grafana, trivy,...

CVE-2026-22741

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, rclone, sftpgo-plugin-auth, k6, cert-manager, zot, bento, flux-source-controller, openbao, trufflehog, gitlab-runner, cert-manager-istio-csr, flux, ratify, telegraf, rancher-agent, external-secrets-operator, juicefs, terraform, frp, dex,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, rclone, sftpgo-plugin-auth, k6, cert-manager, zot, bento, flux-source-controller, openbao, trufflehog, gitlab-runner, cert-manager-istio-csr, flux, ratify, telegraf, rancher-agent, external-secrets-operator, juicefs, terraform, frp, dex,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: grafana-fips, gitlab-runner, vault, cert-manager-google-cas-issuer, external-secrets-operator, ldap2pg, trufflehog-fips, rclone-fips, grafana, yunikorn-k8shim-fips, dex-fips, dex, cert-manager-openshift-routes-fips, cert-manager-cmctl, cert-manager, cert-manager-fips...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: grafana-fips, gitlab-runner, vault, cert-manager-google-cas-issuer, external-secrets-operator, ldap2pg, trufflehog-fips, rclone-fips, grafana, yunikorn-k8shim-fips, dex-fips, dex, cert-manager-openshift-routes-fips, cert-manager-cmctl, cert-manager, cert-manager-fips...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: skaffold, grafana-alloy-fips, apko, kubevela-fips, grafana-fips, gitlab-runner, external-secrets-operator, chainctl-fips, trufflehog-fips, mapotf, commercial-chainloop-cli, grype-db, trivy-operator, crossplane-fips, pulumi-language-dotnet, grafana, trivy,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, tflint, aactl, zot, goreleaser, flux-source-controller, ko, policy-controller, zarf, tkn, ratify, neuvector-sigstore-interface, buildkitd, skaffold, vexctl, gh, gitsign, trivy-operator, falcoctl, spire-server, docker-cli-buildx, teleport, witnes...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, tflint, aactl, zot, goreleaser, flux-source-controller, ko, policy-controller, zarf, tkn, ratify, neuvector-sigstore-interface, buildkitd, skaffold, vexctl, gh, gitsign, trivy-operator, falcoctl, spire-server, docker-cli-buildx, teleport, witnes...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: cilium-cli, envoy-gateway, zot, flux-source-controller, istio, chart-testing, rancher-fleet, helm-push, headlamp, zarf, flux, helm-set-status, tw, kuma, helm-mapkubeapis, trivy-operator, kube-arangodb, chartmuseum, helm-operator, k8ssandra-client, cerbos, kots,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: cilium-cli, envoy-gateway, zot, flux-source-controller, istio, chart-testing, rancher-fleet, helm-push, headlamp, zarf, flux, helm-set-status, tw, kuma, helm-mapkubeapis, trivy-operator, kube-arangodb, chartmuseum, helm-operator, k8ssandra-client, cerbos, kots,...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, kuma, cert-manager-cmctl-fips, helm-diff-fips, rancher-fleet, flux-fips, flux-source-controller-fips, gitlab-operator, gitlab-operator-fips, helm-diff, flux, kots, zarf, rancher-fleet-fips, zarf-fips, flux-source-controller, cilium-cli, helm-push...