CVE-2026-40109: Improper Authentication

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

PT-2026-31735

Name of the Vulnerable Software and Affected Versions Flux notification-controller versions prior to 1.8.3 Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, nginx-kubernetes-ingress-fips, boring-registry-fips, gitlab-workhorse-ce, tekton-chains-fips, sops, opencost, spicedb, kubescape-server, elastic-agent-fips, terragrunt, loki-fips, k3d, agentbeat-fips, terraform-provider-acme, ksops, zarf,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, grype, bom, melange, grype-db, flux-image-automation-controller, flux-source-controller, chainctl, argocd-image-updater, nuclei, kubescape-server, guac, trivy-operator-fips, external-secrets-operator, rancher-fleet, grafana-alloy-fips,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, grype, bom, melange, grype-db, flux-image-automation-controller, flux-source-controller, chainctl, argocd-image-updater, nuclei, kubescape-server, guac, trivy-operator-fips, external-secrets-operator, rancher-fleet, grafana-alloy-fips,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, grype, bom, melange, grype-db, flux-image-automation-controller, flux-source-controller, chainctl, argocd-image-updater, nuclei, kubescape-server, guac, trivy-operator-fips, external-secrets-operator, rancher-fleet, grafana-alloy-fips,...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: opencost, ferretdb, glab, jaeger, datadog-agent, osv-scanner...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: opencost, ferretdb, glab, jaeger, datadog-agent, osv-scanner...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: opencost, ferretdb, glab, jaeger, datadog-agent, osv-scanner...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: flux-operator-fips, gitlab-workhorse-ce-fips, ferretdb, osv-scanner, jaeger-fips, jaeger, opencost, flux-operator, datadog-agent-fips, glab, opencost-fips, datadog-agent, gitlab-workhorse-ce, livekit-cli...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: flux-operator-fips, gitlab-workhorse-ce-fips, ferretdb, osv-scanner, jaeger-fips, jaeger, opencost, flux-operator, datadog-agent-fips, glab, opencost-fips, datadog-agent, gitlab-workhorse-ce, livekit-cli...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: flux-operator-fips, gitlab-workhorse-ce-fips, ferretdb, osv-scanner, jaeger-fips, jaeger, opencost, flux-operator, datadog-agent-fips, glab, opencost-fips, datadog-agent, gitlab-workhorse-ce, livekit-cli...

CVE-2026-22737 Spring Framework Improper Path Limitation with Script View Templates

Use of Java scripting engine enabled e.g. JRuby, Jython template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: knative-net-istio-fips, timescaledb-parallel-copy, cfssl-fips, fleet-server, crossplane-provider-aws-eks-fips, crossplane-provider-kubernetes-fips, pvc-autoresizer-fips, jaeger-fips, prometheus-elasticsearch-exporter-fips, ingress-nginx-controller-fips, nri-rabbitmq,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, fleet-server, crossplane-provider-aws-eks-fips, apache-beam-java-sdk, omni, datadog-agent-fips, crossplane-provider-aws-efs, caddy-fips, melange, crossplane-provider-aws-rds, external-dns-fips, mattermost-fips, sops, chainctl, harbor-fips,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, fleet-server, crossplane-provider-aws-eks-fips, apache-beam-java-sdk, omni, datadog-agent-fips, crossplane-provider-aws-efs, caddy-fips, melange, crossplane-provider-aws-rds, external-dns-fips, mattermost-fips, sops, chainctl, harbor-fips,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: knative-net-istio-fips, boring-registry-fips, gitlab-workhorse-ce, tekton-chains-fips, sops, ferretdb, opencost, spicedb, kubescape-server, elastic-agent-fips, terragrunt, loki-fips, cri-tools, k3d, flux-notification-controller-fips, ksops, zarf,...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: flux-operator-fips, gitlab-workhorse-ce-fips, ferretdb, osv-scanner, jaeger-fips, jaeger, opencost, github-mcp-server, flux-operator, datadog-agent-fips, opencost-fips, datadog-agent, gptscript, gitlab-workhorse-ce...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: flux-operator-fips, gitlab-workhorse-ce-fips, ferretdb, osv-scanner, jaeger-fips, jaeger, opencost, github-mcp-server, flux-operator, datadog-agent-fips, opencost-fips, datadog-agent, gptscript, gitlab-workhorse-ce...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: policy-controller, terraform-provider-azuread, crossplane-provider-family-azure, openbao, flux-source-controller, grype, opentofu, goreleaser, crossplane-provider-aws-cloudfront, pulumi, sops, crossplane, cluster-api, pulumi-language-java, kyverno-notation-aws,...