GO-2023-2412 vulnerabilities

Vulnerabilities for packages: kubevela, up, skaffold, k3d, helm, grype, kubescape, fuse-overlayfs-snapshotter, flux-helm-controller, k8sgpt, flux-source-controller, melange, ctop, newrelic-infrastructure-agent, gitness, kaniko, kots, helm-push, zot, eksctl, buildkitd, cilium-cli, trivy...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: headlamp, trivy-operator, kubevela, helm-operator, osv-scanner, cert-manager-cmctl, cluster-api-helm-controller, envoy-gateway, nerdctl, rancher-helm, docker-compose, skaffold, opa, tw, helm, xeol, k3s, opa-envoy, grype, kubescape, gogatekeeper, k8ssandra-client,...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: helm-operator, cert-manager-cmctl, cluster-api-helm-controller, envoy-gateway, rancher-helm, helm-docs, tw, cerbos, pluto, k8ssandra-client, flux-helm-controller, k9s, k8sgpt, flux-source-controller, rancher-fleet, istio, chartmuseum, kots, kargo, helm-push, linkerd2...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: headlamp, helm-operator, kyverno-notation-aws, rabbitmq-default-user-credential-updater, cloud-sql-proxy, cluster-api-helm-controller, nri-haproxy, emissary, nats-server-config-reloader, spire-controller-manager, harbor-registry, fulcio, k8sgateway,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, kubevela, slsa-verifier, gitsign, sigstore-scaffolding, scorecard, flux-image-reflector-controller, guac, fulcio, terraform-provider-azurerm, ksops, flux-image-automation-controller, grafana-mimir, terragrunt, k3d, src-fingerprint, k3s,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: livekit-cli, docker-cli-buildx-fips, rancher-agent, helm-mapkubeapis, datadog-agent, chaos-mesh-fips, datadog-agent-fips, envoy-gateway-fips, kube-arangodb-fips, crossplane-fips, chartmuseum-fips, kgateway-fips, helmfile, kubescape, helm-exporter-fips, headlamp-fips,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: headlamp, trivy-operator, kubevela, helm-operator, osv-scanner, tigera-operator, scorecard, cluster-api-helm-controller, teleport, envoy-gateway, rancher-helm, docker-compose, skaffold, opa, rancher-agent, tw, helm, xeol, k3s, opa-envoy, grype, kubescape, gogatekeepe...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: headlamp, trivy-operator, kubevela, helm-operator, osv-scanner, tigera-operator, scorecard, cluster-api-helm-controller, teleport, envoy-gateway, rancher-helm, docker-compose, skaffold, opa, rancher-agent, tw, helm, xeol, k3s, opa-envoy, grype, kubescape, gogatekeepe...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: livekit-cli, docker-cli-buildx-fips, rancher-agent, helm-mapkubeapis, datadog-agent, chaos-mesh-fips, datadog-agent-fips, envoy-gateway-fips, kube-arangodb-fips, opa-fips-envoy, chartmuseum-fips, kgateway-fips, kubescape, helm-exporter-fips, headlamp-fips, spegel,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: headlamp, trivy-operator, helm-operator, cert-manager-cmctl, cluster-api-helm-controller, envoy-gateway, helm-docs, tw, helm, cerbos, pluto, kubescape, k8ssandra-client, nova, helm-set-status, consul-k8s, k9s, k8sgpt, flux-source-controller, kube-arangodb,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: headlamp, trivy-operator, helm-operator, cert-manager-cmctl, cluster-api-helm-controller, envoy-gateway, helm-docs, tw, helm, cerbos, pluto, kubescape, k8ssandra-client, nova, helm-set-status, consul-k8s, k9s, k8sgpt, flux-source-controller, kube-arangodb,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: dkron, stakater-reloader, github-mcp-server, grafana-rollout-operator, apko, osv-scanner, oras, mountpoint-s3-csi-driver, flux-image-reflector-controller, envoy-ratelimit, go, karpenter, victoriametrics-cluster, flux-image-automation-controller, grafana-operator,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, kyverno-notation-aws, nfpm, wal-g, terragrunt, src-fingerprint, cerbos, crossplane-provider-aws-s3, vcluster, goreleaser, wolfictl, crossplane-provider-aws-ec2, rclone, crossplane-provider-aws-sqs, gomplate, helm-push, syft,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, kyverno-notation-aws, nfpm, wal-g, terragrunt, src-fingerprint, cerbos, crossplane-provider-aws-s3, vcluster, goreleaser, wolfictl, crossplane-provider-aws-ec2, rclone, crossplane-provider-aws-sqs, gomplate, helm-push, syft,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: nri-kafka-fips, cephcsi-fips, regclient-fips, step-kms-plugin-fips, gomplate-fips, docker-cli-buildx-fips, kyverno-notation-aws, podinfo-fips, regclient, fluent-operator, jobset, skopeo, opa-fips-envoy, kubernetes-dashboard-web-fips, direnv, cloud-provider-azure-fips...

BIT-FLUX-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-6887

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: gendesk, glow, rancher-agent, spark-operator, kyverno-notation-aws, regclient, tflint, kind, fzf, mongo-tools, dive, harbor, consul, yunikorn-k8shim, prometheus-operator, nri-f5, gobuster, rabbitmq-cluster-operator, cloud-provider-vsphere, cilium-cli, harbor-registry...

CVE-2025-55199 vulnerabilities

Vulnerabilities for packages: headlamp, trivy-operator, helm-operator, cert-manager-cmctl, cluster-api-helm-controller, envoy-gateway, helm-docs, tw, cerbos, pluto, kubescape, k8ssandra-client, nova, helm-set-status, flux-helm-controller, k9s, k8sgpt, flux-source-controller, rancher-fleet, istio,...