GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, crossplane-provider-azure-sql, chainctl-fips, amazon-ssm-agent, minio, crossplane-provider-aws-lexmodels, caddy, chainloop-control-plane-fips, omnictl-multiarch, crossplane-provider-aws-athena-fips, flux-notification-controller, chainloop-cli,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: tekton-pipelines, chezmoi, chainctl-fips, flux-source-controller, amazon-ssm-agent, minio, witness, fscrypt, opentofu-fips, skaffold, knative-serving-fips, commercial-expanso-edge, knative-eventing-fips, k9s-fips, calico-fips, trivy-operator-fips, cloudbeat-fips,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, cloud-provider-aws, rancher, flux-image-automation-controller, gitlab-kas, minio, osv-scanner, flux-source-controller, aactl, gitea, knative-serving, kots, telegraf, containerd, spire-server, opentelemetry-collector, kaf, istio,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: rancher, cluster-api-azure-controller, gatus, sops, aactl, nuclei, melange, glab, knative-serving, containerd, spire-server, external-secrets-operator, terraform-provider-azurerm, hcloud, vault-benchmark, crossplane-provider-azure-sql, flux-kustomize-controller,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: rancher, cluster-api-azure-controller, crossplane-provider-aws-dynamodb, gatus, sops, aactl, nuclei, melange, glab, knative-serving, containerd, spire-server, crossplane-provider-aws-firehose, gitlab-pages, external-secrets-operator, terraform-provider-azurerm, hclou...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: rancher, cluster-api-azure-controller, crossplane-provider-aws-dynamodb, gatus, sops, aactl, nuclei, melange, glab, knative-serving, containerd, spire-server, crossplane-provider-aws-firehose, gitlab-pages, external-secrets-operator, terraform-provider-azurerm, hclou...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, cloud-provider-aws, rancher, gitlab-kas, minio, aactl, knative-serving, kots, telegraf, containerd, spire-server, opentelemetry-collector, kaf, istio, prometheus-operator, cilium-cli, prometheus, mattermost, k3s, nerdctl, snyk-cli, external-dns,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, cloud-provider-aws, rancher, flux-image-automation-controller, gitlab-kas, minio, osv-scanner, flux-source-controller, aactl, gitea, knative-serving, kots, telegraf, containerd, spire-server, opentelemetry-collector, kaf, istio,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: rancher, aactl, nuclei, melange, knative-serving, containerd, spire-server, external-secrets-operator, cilium-cli, k9s, nerdctl, helm, pulumi-language-java, syft, apko, openbao, trivy, pulumi, osv-scanner, gitea, terragrunt, telegraf, step-kms-plugin,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, cloud-provider-aws, flux-image-automation-controller, gitlab-kas, minio, wolfictl, osv-scanner, flux-source-controller, aactl, gitea, guac, terragrunt, nuclei, melange, knative-serving, kots, scorecard, telegraf, containerd, spire-server, dagger...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: aws-node-termination-handler, azure-service-operator, tekton-pipelines, crossplane-provider-azure-sql, trillian, chainctl-fips, minio, rke2-runtime-fips, caddy, kapp-controller, tetragon, cortex-fips, conftest, kyverno-policy-reporter-fips, goreleaser,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: aws-node-termination-handler, azure-service-operator, tekton-pipelines, crossplane-provider-azure-sql, trillian, chainctl-fips, minio, rke2-runtime-fips, caddy, kapp-controller, tetragon, cortex-fips, conftest, kyverno-policy-reporter-fips, goreleaser,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: rancher, emissary, yunikorn-k8shim, gatus, grafana-alloy, goreleaser, aactl, kubo, coredns, nuclei, victoriametrics-operator, grafana-agent-operator, knative-serving, trillian, cert-manager-webhook-pdns, vault-env, containerd, spire-server, aws-efs-csi-driver,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: rancher, emissary, yunikorn-k8shim, gatus, grafana-alloy, goreleaser, aactl, kubo, coredns, nuclei, victoriametrics-operator, grafana-agent-operator, knative-serving, trillian, cert-manager-webhook-pdns, vault-env, containerd, spire-server, aws-efs-csi-driver,...

GHSA-X23C-287F-QQV5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

UBUNTU-CVE-2026-41842

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

EUVD-2026-35342

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

EUVD-2026-35330

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

CVE-2026-41842 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...