GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: manifest-tool, spegel, trivy-operator-fips, linkerd2, amazon-ecs-agent-fips, kubescape, kaniko-fips, chartmuseum, chartmuseum-fips, kgateway-fips, helmfile, zarf-fips, cg, cluster-api-helm-controller-fips, xeol, helm-operator-fips, harvester-fips, steampipe,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: spegel, opa-envoy, containerd, headlamp, docker-cli-buildx, kube-arangodb, docker, kubescape-operator, manifest-tool, steampipe, chartmuseum, eksctl, helm-mapkubeapis, kaniko, helm-push, kots, consul-k8s, kubescape, helm-set-status, k8sgpt, grype, linkerd2, k9s,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: spegel, opa-envoy, containerd, headlamp, docker-cli-buildx, kube-arangodb, docker, kubescape-operator, manifest-tool, steampipe, chartmuseum, eksctl, helm-mapkubeapis, kaniko, helm-push, kots, consul-k8s, kubescape, helm-set-status, k8sgpt, grype, linkerd2, k9s,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: manifest-tool, spegel, trivy-operator-fips, linkerd2, amazon-ecs-agent-fips, kubescape, containerd-fips, kaniko-fips, chartmuseum, chartmuseum-fips, kgateway-fips, zarf-fips, cg, cluster-api-helm-controller-fips, xeol, helm-operator-fips, steampipe, rancher-agent,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: headlamp, kube-arangodb, chartmuseum, eksctl, helm-mapkubeapis, kots, helm-push, consul-k8s, kubescape, cert-manager-cmctl, istio, linkerd2, k9s, rancher-fleet, cilium-cli, trivy, pluto, tigera-operator, k8ssandra-client, flux-source-controller, envoy-gateway,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: headlamp, kube-arangodb, chartmuseum, eksctl, helm-mapkubeapis, kots, helm-push, consul-k8s, kubescape, cert-manager-cmctl, istio, linkerd2, k9s, rancher-fleet, cilium-cli, trivy, pluto, tigera-operator, k8ssandra-client, flux-source-controller, envoy-gateway,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, gh, grafana-rollout-operator, omnibump, dkron, oras, mountpoint-s3-csi-driver, newrelic-k8s-metadata-injection, grafana-operator, envoy-ratelimit, aws-network-policy-agent, go, apko, kubewatch, clickhouse-operator, external-secrets-operator,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: vcluster, docker-cli-buildx, crossplane-provider-aws-sns, crossplane-provider-azure-storage, docker, crossplane-provider-aws-kinesis, sops, argo-workflows, apko, crossplane-provider-aws-s3, lazygit, dagger, crossplane-provider-keycloak, kyverno-notation-aws,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: vcluster, docker-cli-buildx, crossplane-provider-aws-sns, crossplane-provider-azure-storage, docker, crossplane-provider-aws-kinesis, sops, argo-workflows, apko, crossplane-provider-aws-s3, lazygit, dagger, crossplane-provider-keycloak, kyverno-notation-aws,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis-fips, kubernetes-dashboard-metrics-scraper, shfmt, tempo, longhorn-manager-fips, victoriametrics, ip-masq-agent, crossplane-provider-aws-rds, flannel-fips, go-jsonnet, kube-metrics-adapter-fips, linkerd2, vertical-pod-autoscaler-fips,...

BIT-FLUX-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-6887

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: azure-service-operator, nri-haproxy, tempo, dgraph, witness, ip-masq-agent, cluster-api, nri-redis, libnvidia-container, rabbitmq-messaging-topology-operator, kubecolor, chartmuseum, nats-server-config-reloader, aws-eks-pod-identity-agent, undock, kube-bench, caddy,...

CVE-2025-55199 vulnerabilities

Vulnerabilities for packages: headlamp, chartmuseum, eksctl, helm-mapkubeapis, kots, helm-push, consul-k8s, kubescape, k8sgpt, cert-manager-cmctl, istio, linkerd2, k9s, rancher-fleet, flux-helm-controller, cilium-cli, trivy, pluto, kargo, k8ssandra-client, flux-source-controller, envoy-gateway,...

CVE-2025-55198 vulnerabilities

Vulnerabilities for packages: headlamp, chartmuseum, eksctl, helm-mapkubeapis, kots, helm-push, consul-k8s, kubescape, k8sgpt, cert-manager-cmctl, istio, linkerd2, k9s, rancher-fleet, flux-helm-controller, cilium-cli, trivy, pluto, kargo, k8ssandra-client, flux-source-controller, envoy-gateway,...

GHSA-F9F8-9PMF-XV68 vulnerabilities

Vulnerabilities for packages: headlamp, chartmuseum, eksctl, helm-mapkubeapis, kots, helm-push, consul-k8s, kubescape, k8sgpt, cert-manager-cmctl, istio, linkerd2, k9s, rancher-fleet, flux-helm-controller, cilium-cli, trivy, pluto, kargo, k8ssandra-client, flux-source-controller, envoy-gateway,...

GHSA-9H84-QMV7-982P vulnerabilities

Vulnerabilities for packages: headlamp, chartmuseum, eksctl, helm-mapkubeapis, kots, helm-push, consul-k8s, kubescape, k8sgpt, cert-manager-cmctl, istio, linkerd2, k9s, rancher-fleet, flux-helm-controller, cilium-cli, trivy, pluto, kargo, k8ssandra-client, flux-source-controller, envoy-gateway,...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: trivy, trivy-fips, flux-source-controller, kuma, pluto, helm-docs, flux-fips, consul-k8s-fips, helm-push, kubescape, flux-source-controller-fips, chartmuseum, flux-helm-controller, chartmuseum-fips, zarf, consul-k8s, rancher-helm, cluster-api-helm-controller-fips,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: trivy, trivy-fips, flux-source-controller, kuma, pluto, helm-docs, flux-fips, consul-k8s-fips, helm-push, kubescape, flux-source-controller-fips, chartmuseum, flux-helm-controller, chartmuseum-fips, zarf, consul-k8s, rancher-helm, cluster-api-helm-controller-fips,...