CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: kyverno, coder, grype-db, kargo, crossplane-fips, grafana-alloy-fips, pulumi-language-dotnet, kyverno-fips, snyk-cli, k9s-fips, k9s, kaniko, argo-cd, gitea, goreleaser, dagger, witness, guac, kots, mapotf, pulumi, osv-scanner, chainctl-fips, jfrog-cli, trufflehog-fip...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: kyverno, coder, grype-db, kargo, crossplane-fips, grafana-alloy-fips, pulumi-language-dotnet, kyverno-fips, snyk-cli, k9s-fips, k9s, kaniko, argo-cd, gitea, goreleaser, dagger, witness, guac, kots, mapotf, pulumi, osv-scanner, chainctl-fips, jfrog-cli, trufflehog-fip...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: trivy, guac, trufflehog, zarf, nuclei, argocd-image-updater, gomplate, argo-workflows, cerbos, nfpm, gitaly, gitea, trivy-operator, tfsec, grafana-alloy, dagger, xeol, flux-image-automation-controller, scorecard, wolfictl, kaniko, grype, external-secrets-operator,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: trivy, guac, trufflehog, zarf, nuclei, argocd-image-updater, gomplate, argo-workflows, cerbos, nfpm, gitaly, gitea, trivy-operator, tfsec, grafana-alloy, dagger, xeol, flux-image-automation-controller, scorecard, wolfictl, kaniko, grype, external-secrets-operator,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: kyverno, coder, grype-db, kargo, crossplane-fips, grafana-alloy-fips, pulumi-language-dotnet, kyverno-fips, snyk-cli, k9s-fips, k9s, kaniko, argo-cd, gitea, goreleaser, dagger, witness, guac, kots, mapotf, pulumi, osv-scanner, chainctl-fips, jfrog-cli, trufflehog-fip...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: trivy, guac, docker, zarf, docker-cli-buildx, tekton-chains, tflint, gh, spire-server, tkn, buildkitd, rekor, trivy-operator, cosign, dagger, policy-controller, falcoctl, bom, kubescape, ratify, kyverno, flux-source-controller, gitlab-runner, slsa-verifier, zot,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: kyverno, chainloop-control-plane, docker-compose-fips, tekton-chains, kyverno-notation-aws, vexctl, crossplane-fips, cosign, kyverno-fips, livekit-cli, neuvector-sigstore-interface, goreleaser, tkn-fips, dagger, guac, spire-server, flux-source-controller-fips,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: kyverno, grype-db, kargo, crossplane-fips, grafana-alloy-fips, pulumi-language-dotnet, kyverno-fips, snyk-cli, k9s-fips, grafana-fips, k9s, kaniko, argo-cd, gitea, goreleaser, dagger, witness, guac, kots, mapotf, pulumi, osv-scanner, flux-source-controller-fips,...

CVE-2026-22741

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: juicefs, trufflehog, nuclei, terraform, percona-server-mongodb-operator, cert-manager-cmctl, minio, rancher, opentofu, spqr, gitea, dex, rancher-agent, grafana, frp, xeol, yunikorn-k8shim, harbor, k6, external-secrets-operator, rancher-webhook, cert-manager-csi-drive...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: juicefs, trufflehog, nuclei, terraform, percona-server-mongodb-operator, cert-manager-cmctl, minio, rancher, opentofu, spqr, gitea, dex, rancher-agent, grafana, frp, xeol, yunikorn-k8shim, harbor, k6, external-secrets-operator, rancher-webhook, cert-manager-csi-drive...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: kyverno, telegraf, yunikorn-k8shim-fips, juicefs, kyverno-notation-aws, kyverno-fips, versitygw-fips, seaweedfs, grafana-fips, rancher-webhook, gitea, dex, external-secrets-fips, flux-source-controller-fips, rancher-webhook-fips, trufflehog-fips, gitea-fips,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: kyverno, telegraf, yunikorn-k8shim-fips, juicefs, kyverno-notation-aws, kyverno-fips, versitygw-fips, seaweedfs, grafana-fips, rancher-webhook, gitea, dex, external-secrets-fips, flux-source-controller-fips, rancher-webhook-fips, trufflehog-fips, gitea-fips,...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: kyverno, grype-db, kargo, crossplane-fips, grafana-alloy-fips, pulumi-language-dotnet, kyverno-fips, snyk-cli, k9s-fips, grafana-fips, k9s, kaniko, argo-cd, gitea, goreleaser, dagger, witness, guac, kots, mapotf, pulumi, osv-scanner, flux-source-controller-fips,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: trivy, zarf, docker, docker-cli-buildx, tekton-chains, tflint, gh, spire-server, tkn, buildkitd, trivy-operator, cosign, policy-controller, falcoctl, kubescape, ratify, kyverno, witness, flux-source-controller, slsa-verifier, zot, crossplane, teleport,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: trivy, zarf, docker, docker-cli-buildx, tekton-chains, tflint, gh, spire-server, tkn, buildkitd, trivy-operator, cosign, policy-controller, falcoctl, kubescape, ratify, kyverno, witness, flux-source-controller, slsa-verifier, zot, crossplane, teleport,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: trivy, zarf, helm-mapkubeapis, cluster-api-helm-controller, kube-arangodb, envoy-gateway, helm-docs, headlamp, cert-manager-cmctl, cerbos, trivy-operator, chart-testing, cilium-cli, eksctl, tw, harbor, helm-set-status, istio, consul-k8s, linkerd2, kuma,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: trivy, zarf, helm-mapkubeapis, cluster-api-helm-controller, kube-arangodb, envoy-gateway, helm-docs, headlamp, cert-manager-cmctl, cerbos, trivy-operator, chart-testing, cilium-cli, eksctl, tw, harbor, helm-set-status, istio, consul-k8s, linkerd2, kuma,...