[SECURITY] Fedora 45 Update: gcr-4.4.1-1.fc45

gcr is a library for displaying certificates, and crypto UI, accessing key stores. It also provides a viewer for crypto files on the GNOME desktop. gck is a library for accessing PKCS11 modules like smart cards...

Fedora 45 : adwaita-icon-theme / dconf / epiphany / gcr / gdm / gjs / etc (2026-48a7996f9c)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-48a7996f9c advisory. GNOME 51.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue b...

GO-2025-4188 vulnerabilities

Vulnerabilities for packages: go-discover, src-fingerprint, sonobuoy, docker-credential-gcr, neuvector-dbgen, newrelic-nri-statsd, php-fpmexporter, terraform-provider-google, aws-flb-firehose, kubeflow, hello-world-golang, kpt, aws-flb-cloudwatch, kube-fluentd-operator, gostatsd, aws-flb-kinesis,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kapp, ko, cloud-provider-gcp-cloud-controller-manager, flux, hubble, cis-operator, argo-events, kpt, kubecolor, kind, trivy, rancher-system-agent, ini-file, azure-service-operator, kubernetes-dashboard, nri-redis, wire-go, aws-otel-collector, lazydocker,...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-ui, ko, cert-manager-cmctl, newrelic-infrastructure-agent, flux, hubble, cis-operator, argo-events, kpt, kubescape, kubescape-operator, flux-helm-controller, pulumi-language-yaml, memcached-exporter, ingress-nginx-controller, rancher-agent,...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the authentication for Google OIDC tokens in the GCR Receiver webhook endpoint. An attacker can trigger unauthorized reconciliation of resources by presenting any valid Google-issued...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2025-65637 vulnerabilities

Vulnerabilities for packages: go-discover, src-fingerprint, sonobuoy, docker-credential-gcr, neuvector-dbgen, newrelic-nri-statsd, php-fpmexporter, terraform-provider-google, aws-flb-firehose, kubeflow, hello-world-golang, kpt, aws-flb-cloudwatch, kube-fluentd-operator, gostatsd, aws-flb-kinesis,...

GHSA-4VQ8-7JFC-9CVP vulnerabilities

Vulnerabilities for packages: vault, bom, portieris, crossplane, falcoctl-fips, xeol, redpanda, cluster-api-fips, harbor, promxy, tekton-pipelines-fips, harbor-scanner-trivy-fips, beats-fips, rke2-runtime, harvester-fips, docker-credential-gcr, rancher-agent, kpt, opentelemetry-operator,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: grype, temporal-server, nri-elasticsearch, newrelic-infrastructure-agent, flux, pulumi-language-yaml, kpt, ferretdb, kind, flux-helm-controller, litefs, memcached-exporter, k8sgpt-operator, cfssl, go-licenses, kine, kubernetes-dashboard, nri-redis, cert-exporter,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: grype, temporal-server, nri-elasticsearch, newrelic-infrastructure-agent, flux, pulumi-language-yaml, kpt, ferretdb, kind, flux-helm-controller, litefs, memcached-exporter, k8sgpt-operator, cfssl, go-licenses, kine, kubernetes-dashboard, nri-redis, cert-exporter,...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: buildkitd, argo-workflows-fips, bom, cadvisor, falcoctl-fips, helm-operator, argo-workflows, crane, policy-controller-fips, pulumi, cosign, dagger, gitsign, helm-operator-fips, trivy, docker-credential-gcr, slsa-verifier, kpt, k3s, nerdctl, chartmuseum, helm, kots,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: buildkitd, argo-workflows-fips, bom, cadvisor, falcoctl-fips, helm-operator, argo-workflows, crane, policy-controller-fips, pulumi, cosign, dagger, gitsign, helm-operator-fips, trivy, docker-credential-gcr, slsa-verifier, kpt, k3s, nerdctl, chartmuseum, helm, kots,...

Kubernetes Secrets of Fortune 500 Companies Exposed in Public Repositories

Cybersecurity researchers are warning of publicly exposed Kubernetes configuration secrets that could put organizations at risk of supply chain attacks. "These encoded Kubernetes configuration secrets were uploaded to public repositories," Aqua security researchers Yakir Kadkoda and Assaf Morag...

Google Warns How Hackers Could Abuse Calendar Service as a Covert C2 Channel

Google is warning of multiple threat actors sharing a public proof-of-concept PoC exploit that leverages its Calendar service to host command-and-control C2 infrastructure. The tool, called Google Calendar RAT GCR, employs Google Calendar Events for C2 using a Gmail account. It was first publishe...