CLEANSTART-2026-QV19791 Security fix for GHSA-gcjh-h69q-9w9g applied in: external-secrets-operator-fips 2.12.0-r1, flux-helm-controller 1.6.4-r1

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VN99750 oras-go is a Go library for managing OCI artifacts

Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...

CLEANSTART-2026-VP35771 oras-go is a Go library for managing OCI artifacts

Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...

CLEANSTART-2026-AH23737 oras-go is a Go library for managing OCI artifacts

Security vulnerability affects the flux-helm-controller package. oras-go is a Go library for managing OCI artifacts...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: k9s, helm-set-status, k8sgpt, rancher-helm, kyverno-notation-aws, xeol, kube-arangodb, cert-manager-cmctl, gitness, cluster-api-helm-controller, opentofu, manifest-tool, flux-helm-controller, maru, kargo, helm-push, helm-mapkubeapis...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: k9s, helm-set-status, k8sgpt, rancher-helm, kyverno-notation-aws, xeol, kube-arangodb, cert-manager-cmctl, gitness, cluster-api-helm-controller, opentofu, manifest-tool, flux-helm-controller, maru, kargo, helm-push, helm-mapkubeapis...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: headlamp, trivy-operator, kubevela, helm-operator, scorecard, cluster-api-helm-controller, nerdctl, rancher-helm, docker-compose, skaffold, rancher-agent, xeol, k3s, grype, kubescape, fuse-overlayfs-snapshotter, kubescape-operator, helm-set-status, wolfictl, k9s,...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: k9s, helm-set-status, k8sgpt, rancher-helm, kyverno-notation-aws, xeol, kube-arangodb, cert-manager-cmctl, gitness, cluster-api-helm-controller, opentofu, manifest-tool, flux-helm-controller, maru, kargo, helm-push, helm-mapkubeapis...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, apisix-ingress-controller, helm-operator, kyverno-notation-aws, metallb, fluent-operator, tekton-pipelines, cluster-api-helm-controller, emissary, cluster-api-gcp-controller, cass-operator, metrics-server, kube-rbac-proxy, calico,...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: zarf, kubevela, cilium-cli, trivy, flux-helm-controller, chartmuseum, k9s, flux-source-controller, up, helm-operator, kubescape, helm-push, kots, zot, k8sgpt, eksctl...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: zarf, kubevela, cilium-cli, trivy, flux-helm-controller, chartmuseum, k9s, flux-source-controller, up, helm-operator, kubescape, helm-push, kots, zot, k8sgpt, eksctl...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: cerbos-fips, linkerd2, kargo, helm-operator, harbor-fips, envoy-gateway-fips, kots, harbor, trivy, chartmuseum-fips, flux-helm-controller, flux, rancher-helm, chart-testing, linkerd2-fips, rancher-fleet, cluster-api-helm-controller, zot, k8ssandra-client, cilium-cli,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: rancher-agent, helm-mapkubeapis, kyverno-notation-aws, chaos-mesh-fips, envoy-gateway-fips, kube-arangodb-fips, crossplane-fips, chartmuseum-fips, kgateway-fips, ocm-cli, kubescape, helm-exporter-fips, kyverno-fips, headlamp-fips, cilium-cli, oras-fips, ocm-cli-fips,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: nova, amazon-k8s-cni-fips, metacontroller, terragrunt, nova-fips, temporal-fips, aws-ebs-csi-driver, flux-source-watcher, flux-notification-controller, polaris, go, grafana-fips, flux-helm-controller, victorialogs-fips, flux-operator-fips, victoriametrics-cluster-fip...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: nova, amazon-k8s-cni-fips, metacontroller, terragrunt, nova-fips, temporal-fips, aws-ebs-csi-driver, flux-source-watcher, flux-notification-controller, polaris, go, grafana-fips, flux-helm-controller, victorialogs-fips, flux-operator-fips, victoriametrics-cluster-fip...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: cephcsi-fips, step-kms-plugin-fips, gomplate-fips, docker-cli-buildx-fips, envoy-gateway-fips, jobset, skopeo, kubernetes-dashboard-web-fips, net-kourier-fips, cloud-provider-azure-fips, modelmesh-runtime-adapter, opencost-fips, yunikorn-k8shim, temporal-server,...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: gomplate-fips, docker-cli-buildx-fips, kyverno-notation-aws, skopeo, kubernetes-dashboard-web-fips, cloud-provider-azure-fips, modelmesh-runtime-adapter, temporal-server, opentelemetry-collector, spicedb, packer-fips, step-issuer-fips, envoy-gateway,...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: k9s, k8sgpt, kubevela, flux-source-controller, helm-operator, up, zot, eksctl, chartmuseum, kubescape, trivy, zarf, cilium-cli, flux-helm-controller, kots, helm-push...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: helm-operator, cert-manager-cmctl, cluster-api-helm-controller, rancher-helm, helm-docs, tw, pluto, kubescape, k8ssandra-client, flux-helm-controller, k9s, flux-source-controller, chartmuseum, kots, helm-push, zot, chart-testing, eksctl, zarf, cilium-cli, flux, trivy...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: k9s, k8sgpt, kubevela, flux-source-controller, helm-operator, up, zot, eksctl, chartmuseum, kubescape, trivy, zarf, cilium-cli, flux-helm-controller, kots, helm-push...