GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: osv-scanner, datadog-agent, glab, jaeger, opencost, ferretdb...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: osv-scanner, datadog-agent, glab, jaeger, opencost, ferretdb...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: osv-scanner, jaeger, opencost-fips, datadog-agent-fips, jaeger-fips, datadog-agent, gitlab-workhorse-ce, livekit-cli, flux-operator, opencost, ferretdb, glab, flux-operator-fips, gitlab-workhorse-ce-fips...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: osv-scanner, jaeger, opencost-fips, datadog-agent-fips, jaeger-fips, datadog-agent, gitlab-workhorse-ce, livekit-cli, flux-operator, opencost, ferretdb, glab, flux-operator-fips, gitlab-workhorse-ce-fips...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: osv-scanner, jaeger, opencost-fips, datadog-agent-fips, jaeger-fips, datadog-agent, gitlab-workhorse-ce, livekit-cli, flux-operator, opencost, ferretdb, glab, flux-operator-fips, gitlab-workhorse-ce-fips...

CVE-2026-22737 Spring Framework Improper Path Limitation with Script View Templates

Use of Java scripting engine enabled e.g. JRuby, Jython template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: spicedb-fips, jaeger-operator-fips, podman, prometheus, nats-top, k6-fips, kubernetes-csi-livenessprobe, addon-resizer-fips, blob-csi-fips, prometheus-beat-exporter, kubernetes-dashboard-auth-fips, boring-registry-fips, kubernetes-csi-driver-hostpath,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: descheduler-fips, grafana-alloy, apache-beam-python-3.12-sdk, peerdb-flow, gitlab-cng, crossplane-provider-aws-lambda-fips, gitlab-pages, crossplane-provider-aws-servicediscovery, telegraf, crossplane-provider-aws-cognitoidp-fips, flux-kustomize-controller,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: descheduler-fips, grafana-alloy, apache-beam-python-3.12-sdk, peerdb-flow, gitlab-cng, crossplane-provider-aws-lambda-fips, gitlab-pages, crossplane-provider-aws-servicediscovery, telegraf, crossplane-provider-aws-cognitoidp-fips, flux-kustomize-controller,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: spicedb-fips, jaeger-operator-fips, skaffold, prometheus, kubevirt-cdi-operator, k6-fips, blob-csi-fips, boring-registry-fips, argocd-image-updater-fips, metrics-server, kiali, ferretdb, datadog-operator, cluster-api-gcp-controller, kaniko-fips, boring-registry,...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: osv-scanner, jaeger, opencost-fips, datadog-agent-fips, gptscript, datadog-agent, gitlab-workhorse-ce, jaeger-fips, flux-operator, opencost, ferretdb, flux-operator-fips, github-mcp-server, gitlab-workhorse-ce-fips...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: osv-scanner, jaeger, opencost-fips, datadog-agent-fips, gptscript, datadog-agent, gitlab-workhorse-ce, jaeger-fips, flux-operator, opencost, ferretdb, flux-operator-fips, github-mcp-server, gitlab-workhorse-ce-fips...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: argo-rollouts, trivy, external-secrets-operator, aactl, flux, argo-cd, syft, snyk-cli, extism, vcluster, helm-push, pulumi-language-yaml, pulumi-kubernetes-operator, zot, rancher-fleet, crossplane-provider-azure-authorization, boring-registry, argocd-image-updater,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: argo-rollouts, trivy, external-secrets-operator, aactl, flux, argo-cd, syft, snyk-cli, extism, vcluster, helm-push, pulumi-language-yaml, pulumi-kubernetes-operator, zot, rancher-fleet, crossplane-provider-azure-authorization, boring-registry, argocd-image-updater,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: skaffold, openbao, grafana-alloy, flux-image-automation-controller, gitness, rclone-fips, cert-manager-cmctl, external-secrets-operator-fips, boring-registry-fips, argocd-image-updater-fips, databricks-cli, crossplane-provider-aws-lambda-fips, osv-scanner, opentofu,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: skaffold, openbao, grafana-alloy, flux-image-automation-controller, gitness, rclone-fips, cert-manager-cmctl, external-secrets-operator-fips, boring-registry-fips, argocd-image-updater-fips, databricks-cli, crossplane-provider-aws-lambda-fips, osv-scanner, opentofu,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: spicedb-fips, openfga-fips, openbao, grafana-alloy, beats, trillian-fips, step-kms-plugin-fips, crossplane-provider-sql-fips, juicefs, telegraf, tkn, flux-kustomize-controller, beats-fips, agentbeat, elastic-agent, jitsucom-bulker, dgraph, step-ca, trufflehog,...

SUSE CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

GO-2026-4351 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator...

CVE-2025-61728 vulnerabilities

Vulnerabilities for packages: prometheus, beats, flux-image-automation-controller, nerdctl, gitness, cert-manager-cmctl, kubernetes-dashboard, external-secrets-operator-fips, logstash, osv-scanner, azure-aad-pod-identity-mic, opentofu, telegraf, flux-kustomize-controller, cilium-envoy-fips,...