GO-2026-5013 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-linode, argocd-image-updater, crossplane-provider-aws-iam, terraform-provider-tls, zarf, podman, fscrypt, wolfictl, containerd, crossplane-provider-family-azure, glab, falco-no-driver, crossplane-provider-aws-sqs, pulumi-language-dotnet,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, dive, spire-controller-manager, nova, cluster-api-provider-vsphere, kubernetes-csi-driver-nfs, mockgen, rabbitmq-messaging-topology-operator, containerd, wait-for-port, libnvidia-container, nginx-prometheus-exporter, nri-consul,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, timescaledb-parallel-copy, kubernetes-csi-driver-nfs, podman, cluster-api-aws-controller, fscrypt, rekor, containerd, gke-gcloud-auth-plugin, yq, sbom-scorecard, cloudnative-pg, atlantis, cosign, podinfo, ratify, cfssl, glow,...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: k8sgpt-operator, stern, kubernetes-csi-driver-nfs, podman, cluster-api-aws-controller, rekor, containerd, kserve-modelmesh-serving, crossplane-provider-aws-sqs, crossplane-provider-aws-elasticache, gke-gcloud-auth-plugin, sriov-network-device-plugin,...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: stern, rekor, protoc-gen-go, libnvidia-container, gke-gcloud-auth-plugin, nri-consul, pulumi-kubernetes-operator, newrelic-infrastructure-agent, nri-prometheus, mage, yq, gobuster, sbom-scorecard, kyverno-policy-reporter-kyverno-plugin, prometheus-alertmanager,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, opentelemetry-collector, flux-kustomize-controller, terragrunt, policy-controller, skopeo, tkn, aactl, crossplane-provider-azure-authorization, snyk-cli, scorecard, sigstore-scaffolding, zarf, tekton-chains, rekor, zot, ksops,...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478

Fulcio (certificate authority for OpenID Connect) reports a vulnerability in OIDC discovery across versions up to 1.8.5 where cross-host redirects attach Kubernetes ServiceAccount tokens, enabling blind SSRF, JWKS key substitution/poisoning, and potential leakage of tokens to external hosts. The ...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CLEANSTART-2026-TD64731 Security fixes in fulcio 1.8.7-r2

Package fulcio version 1.8.7-r2 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

CLEANSTART-2026-PE02324 Security fixes in fulcio-fips 1.8.7-r1

Package fulcio-fips version 1.8.7-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791

CVE-2026-48791 affects dev.sigstore:sigstore-java:2.0.0. The vulnerability arises from missing verification of the integratedTime (Rekor) against the Fulcio certificate during bundle verification, later re-added with fixes in 2.1.0. The issue is limited to users verifying bundles with 2.0.0; 2.1....

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

Important: runfinch-finch

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Important: runfinch-finch

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...