CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: helm-push, kuma, flux-fips, rancher-fleet-fips, gitlab-operator, gitlab-operator-fips, flux-source-controller-fips, cert-manager-cmctl-fips, flux-source-controller, cert-manager-cmctl, rancher-fleet, zarf, helm-diff-fips, kots, flux, cilium-cli, helm-diff, zarf-fips...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: helm-push, kuma, flux-fips, rancher-fleet-fips, gitlab-operator, gitlab-operator-fips, flux-source-controller-fips, cert-manager-cmctl-fips, flux-source-controller, cert-manager-cmctl, rancher-fleet, zarf, helm-diff-fips, kots, flux, cilium-cli, helm-diff, zarf-fips...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: helm-push, kuma, flux-fips, rancher-fleet-fips, gitlab-operator, gitlab-operator-fips, flux-source-controller-fips, cert-manager-cmctl-fips, flux-source-controller, cert-manager-cmctl, rancher-fleet, zarf, helm-diff-fips, kots, flux, cilium-cli, helm-diff, zarf-fips...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: helm-push, istio, kubescape, consul-k8s, chart-testing-fips, flux-source-controller, nova-fips, helm-exporter-fips, helm-diff-fips, linkerd2, trivy-operator, harbor, chaos-mesh, helm-operator-fips, cluster-api-helm-controller, cerbos, k9s-fips, pluto-fips,...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: karpenter, kubernetes-dashboard, cloud-provider-aws, newrelic-fluent-bit-output, gitaly, gitlab-kas, ingress-nginx-controller, aactl, libnvidia-container, coredns, redka, aws-flb-kinesis, kots, telegraf, spire-server, gitlab-pages, aws-flb-cloudwatch, falco-no-driver...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: bento, rancher, goreleaser, aactl, coredns, nuclei, vault-env, spire-server, weaviate, envconsul, sonobuoy, k8ssandra-client, gitlab-pages, malcontent, falco-no-driver, external-secrets-operator, k8s-device-plugin, vault-benchmark, falcoctl, cilium-cli, ipfs-cluster,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: karpenter, kubernetes-dashboard, cloud-provider-aws, newrelic-fluent-bit-output, gitaly, gitlab-kas, ingress-nginx-controller, aactl, libnvidia-container, coredns, redka, aws-flb-kinesis, kots, telegraf, spire-server, gitlab-pages, aws-flb-cloudwatch, falco-no-driver...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: karpenter, grafana-rollout-operator, flux-image-automation-controller, dgraph, oras, victoriametrics-cluster, osv-scanner, dbmate, fluxcd-kustomize-mutating-webhook, flux-source-controller, goreleaser, gh, ingress-nginx-controller,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: bento, rancher, emissary, swagger, minio-object-browser, vexctl, yunikorn-k8shim, gatus, terraform-provider-aws, goreleaser, aactl, coredns, nuclei, grafana-agent-operator, spire-controller-manager, knative-serving, trillian, kyverno-policy-reporter-kyverno-plugin,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: bento, rancher, emissary, swagger, minio-object-browser, vexctl, yunikorn-k8shim, gatus, terraform-provider-aws, goreleaser, aactl, coredns, nuclei, grafana-agent-operator, spire-controller-manager, knative-serving, trillian, kyverno-policy-reporter-kyverno-plugin,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: rancher, nuclei, spire-controller-manager, knative-serving, kyverno-policy-reporter-kyverno-plugin, vault-env, custom-pod-autoscaler-operator, hugo-extended, dask-gateway, local-path-provisioner, dataplaneapi, nerdctl, kubernetes-dashboard-auth, helm,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: dkron, smokescreen, podinfo-fips, victorialogs-fips, flux-source-controller, commercial-chainloop-backend, cilium-certgen-fips, flux-image-reflector-controller, commercial-expanso-edge, stakater-reloader, goreleaser, ingress-nginx-controller-fips, go,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: dkron, smokescreen, podinfo-fips, victorialogs-fips, flux-source-controller, commercial-chainloop-backend, cilium-certgen-fips, flux-image-reflector-controller, commercial-expanso-edge, stakater-reloader, goreleaser, ingress-nginx-controller-fips, go,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, chezmoi, commercial-chainloop-backend, fscrypt, opentofu-fips, knative-serving-fips, rke2-runtime-fips, commercial-expanso-edge, knative-eventing-fips, kube-fluentd-operator, k9s-fips, net-kourier, azuredisk-csi, ingress-nginx-controller-fips, go,...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: tekton-pipelines, chezmoi, commercial-chainloop-backend, fscrypt, opentofu-fips, knative-serving-fips, rke2-runtime-fips, commercial-expanso-edge, knative-eventing-fips, kube-fluentd-operator, k9s-fips, net-kourier, azuredisk-csi, ingress-nginx-controller-fips, go,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: tekton-pipelines, amazon-ssm-agent, rke2-runtime-fips, caddy, kube-fluentd-operator, goreleaser, ingress-nginx-controller-fips, image-factory-fips, rabbitmq-messaging-topology-operator, oras-fips, rke2-runtime, etcd-fips, gitlab-operator, libnvidia-container-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, amazon-ssm-agent, rke2-runtime-fips, caddy, kube-fluentd-operator, goreleaser, ingress-nginx-controller-fips, image-factory-fips, rabbitmq-messaging-topology-operator, oras-fips, rke2-runtime, etcd-fips, gitlab-operator, libnvidia-container-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: aws-node-termination-handler, contour, azure-service-operator, kubernetes-dashboard-api-fips, tekton-pipelines, crossplane-provider-azure-sql, trillian, amazon-ssm-agent, lvm-driver-fips, sftpgo-plugin-pubsub, rke2-runtime-fips, caddy, kube-fluentd-operator,...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...