CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: grype-db, syft, packer, cluster-api-helm-controller-fips, spegel-fips, headlamp-fips, kargo, docker-compose-fips, kube-mgmt-fips, containerd-fips, kubevela-fips, neuvector, k3s, chartmuseum-fips, linkerd2, kubescape-server, gogatekeeper, helm, gitlab-rails-ce-fips,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: chart-testing, headlamp, nova, tigera-operator, kubescape, pluto, rancher-fleet, helm-docs, zot, zarf, cerbos, kuma, kots, kube-arangodb, envoy-gateway, harbor, tw, helm-operator, cluster-api-helm-controller, helm-set-status, flux-source-controller, k9s, istio,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: chart-testing, headlamp, nova, tigera-operator, kubescape, pluto, rancher-fleet, helm-docs, zot, zarf, cerbos, kuma, kots, kube-arangodb, envoy-gateway, harbor, tw, helm-operator, cluster-api-helm-controller, helm-set-status, flux-source-controller, k9s, istio,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, flux-notification-controller, gh, local-path-provisioner, secrets-store-csi-driver-provider-aws, aws-privateca-issuer, nova, supercronic, stakater-reloader, nfs-subdir-external-provisioner, dbmate, pluto, tailscale,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, crossplane-provider-aws-route53, crossplane-provider-family-aws, pulumi-language-yaml, grafana-alloy, crossplane-provider-aws-eks, crossplane-provider-aws-rds, osv-scanner, wal-g, gitsign, buildkitd, crossplane-provider-aws-cloudfron...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, crossplane-provider-aws-route53, crossplane-provider-family-aws, pulumi-language-yaml, grafana-alloy, crossplane-provider-aws-eks, crossplane-provider-aws-rds, osv-scanner, wal-g, gitsign, buildkitd, crossplane-provider-aws-cloudfron...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: linkerd2-proxy-init, sftpgo-plugin-auth, longhorn-instance-manager, prometheus-adapter-fips, cilium-certgen-fips, longhorn-cli, kubernetes-csi-external-provisioner, amazon-ssm-agent, cluster-api-helm-controller-fips, overmind, syncthing, terraform-provider-azuread,...

BIT-FLUX-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-6887

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: kubecolor, prometheus, chart-testing, dapr, tflint, nri-rabbitmq, bom, dgraph, dive, kind, vault-csi-provider, portieris, aws-eks-pod-identity-agent, kapp-controller, consul, aws-otel-collector, neuvector, ko, swagger, k8sgateway, k3s, grafana-alloy, delve, kapp,...

CVE-2025-55199 vulnerabilities

Vulnerabilities for packages: chart-testing, headlamp, nova, pluto, rancher-fleet, helm-docs, zot, zarf, cerbos, kots, envoy-gateway, flux-helm-controller, tw, helm-operator, cluster-api-helm-controller, helm-set-status, flux-source-controller, k9s, istio, linkerd2, k8ssandra-client, trivy,...

CVE-2025-55198 vulnerabilities

Vulnerabilities for packages: chart-testing, headlamp, nova, pluto, rancher-fleet, helm-docs, zot, zarf, cerbos, kots, envoy-gateway, flux-helm-controller, helm-operator, cluster-api-helm-controller, helm-set-status, flux-source-controller, k9s, istio, linkerd2, k8ssandra-client, trivy, cilium-cl...

GHSA-F9F8-9PMF-XV68 vulnerabilities

Vulnerabilities for packages: chart-testing, headlamp, nova, pluto, rancher-fleet, helm-docs, zot, zarf, cerbos, kots, envoy-gateway, flux-helm-controller, helm-operator, cluster-api-helm-controller, helm-set-status, flux-source-controller, k9s, istio, linkerd2, k8ssandra-client, trivy, cilium-cl...

GHSA-9H84-QMV7-982P vulnerabilities

Vulnerabilities for packages: chart-testing, headlamp, nova, pluto, rancher-fleet, helm-docs, zot, zarf, cerbos, kots, envoy-gateway, flux-helm-controller, tw, helm-operator, cluster-api-helm-controller, helm-set-status, flux-source-controller, k9s, istio, linkerd2, k8ssandra-client, trivy,...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: zot, flux-source-controller-fips, helm-push, cluster-api-helm-controller-fips, kuma, cert-manager-cmctl-fips, chart-testing, flux-source-controller, cluster-api-helm-controller, kubescape, consul-k8s, helm-operator-fips, flux-helm-controller-fips, k9s, pluto,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: zot, flux-source-controller-fips, helm-push, cluster-api-helm-controller-fips, kuma, cert-manager-cmctl-fips, chart-testing, flux-source-controller, cluster-api-helm-controller, kubescape, consul-k8s, helm-operator-fips, flux-helm-controller-fips, k9s, pluto,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, ctop, neuvector-scanner, opa-envoy, k3s, rancher-fleet, zot, xeol, zarf, osv-scanner, kots, kubevela, buildkitd, spegel, envoy-gateway, dagger, flux-helm-controller, melange, helm-operator, cluster-api-helm-controller, opa,...

CVE-2022-36049

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

BIT-HELM-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...