GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, pulumi, rekor, flux-source-controller, gh, falcoctl, cosign, ksops, kubernetes-event-exporter, neuvector-sigstore-interface, opentelemetry-collector-contrib, step-ca, gomplate, flux-image-reflector-controller, slsa-verifier, aact...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: jfrog-cli, zot, docker-compose, grype-fips, amazon-ecs-agent-fips, cloudbeat-fips, kgateway-fips, docker-cli-buildx-fips, kubevela-fips, fuse-overlayfs-snapshotter, manifest-tool, docker-compose-fips, chainctl, teleport, kubescape-server-fips, k8sgpt, envoy-gateway,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, datadog-agent, steampipe, osv-scanner, dagger, kube-arangodb, consul-k8s, opa, wolfictl, helm-push, kubescape-operator, containerd, k8sgpt, docker, trivy-operator, teleport, zot, gogatekeeper, scorecard, kubevela, zarf, syft, falco-no-driver,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, datadog-agent, steampipe, osv-scanner, dagger, kube-arangodb, consul-k8s, opa, wolfictl, helm-push, kubescape-operator, containerd, k8sgpt, docker, trivy-operator, teleport, zot, gogatekeeper, scorecard, kubevela, zarf, syft, falco-no-driver,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: jfrog-cli, zot, docker-compose, grype-fips, amazon-ecs-agent-fips, cloudbeat-fips, kgateway-fips, docker-cli-buildx-fips, kubevela-fips, fuse-overlayfs-snapshotter, manifest-tool, docker-compose-fips, chainctl, teleport, kubescape-server-fips, k8sgpt, gogatekeeper,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, cerbos, flux-source-controller, cluster-api-helm-controller, istio, nova, kube-arangodb, consul-k8s, helm-push, trivy-operator, cilium-cli, zot, helm-docs, zarf, cert-manager-cmctl, rancher-fleet, k8ssandra-client, k9s, chartmuseum, kots,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, cerbos, flux-source-controller, cluster-api-helm-controller, istio, nova, kube-arangodb, consul-k8s, helm-push, trivy-operator, cilium-cli, zot, helm-docs, zarf, cert-manager-cmctl, rancher-fleet, k8ssandra-client, k9s, chartmuseum, kots,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, envoy-ratelimit, victoriametrics-cluster, sftpgo-plugin-eventsearch, flux-source-controller, gh, dkron, osv-scanner, nova, malcontent, stakater-reloader, flux-image-reflector-controller, mariadb-operator, grafana-rollout-operator...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: cluster-api, flux-source-controller, datadog-agent, osv-scanner, pulumi-language-java, wolfictl, lazygit, extism, scorecard, zarf, pulumi-kubernetes-operator, sops, gitness, wal-g, src-fingerprint, vcluster, ratify, crossplane-provider-aws-memorydb, docker-cli-buildx...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: cluster-api, flux-source-controller, datadog-agent, osv-scanner, pulumi-language-java, wolfictl, lazygit, extism, scorecard, zarf, pulumi-kubernetes-operator, sops, gitness, wal-g, src-fingerprint, vcluster, ratify, crossplane-provider-aws-memorydb, docker-cli-buildx...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: spark-operator, jobset-fips, stakater-reloader-fips, mongodb-kubernetes-operator-fips, prometheus-statsd-exporter, aws-otel-collector-fips, crossplane-provider-aws-sns-fips, keda-fips, authentik-fips, crossplane-provider-aws-cloudfront,...

BIT-FLUX-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-6887

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: spark-operator, zot, kube-bench, rancher-system-agent, conftest, contour, gobuster, nri-f5, polaris, undock, cluster-api-azure-controller, cluster-api, gcp-compute-persistent-disk-csi-driver, cloud-provider-vsphere, teleport, guac, gobump, nats-server-config-reloader...

CVE-2025-55199 vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, cerbos, flux-source-controller, istio, nova, helm-push, k8sgpt, cilium-cli, trivy-operator, zot, helm-docs, zarf, cert-manager-cmctl, rancher-fleet, k8ssandra-client, k9s, kargo, chartmuseum, flux-helm-controller, kots, pluto, helm-operator,...

CVE-2025-55198 vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, cerbos, flux-source-controller, istio, nova, helm-push, k8sgpt, cilium-cli, trivy-operator, zot, helm-docs, zarf, cert-manager-cmctl, rancher-fleet, k8ssandra-client, k9s, kargo, chartmuseum, flux-helm-controller, kots, pluto, helm-operator,...

GHSA-F9F8-9PMF-XV68 vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, cerbos, flux-source-controller, istio, nova, helm-push, k8sgpt, cilium-cli, trivy-operator, zot, helm-docs, zarf, cert-manager-cmctl, rancher-fleet, k8ssandra-client, k9s, kargo, chartmuseum, flux-helm-controller, kots, pluto, helm-operator,...

GHSA-9H84-QMV7-982P vulnerabilities

Vulnerabilities for packages: envoy-gateway, linkerd2, cerbos, flux-source-controller, istio, nova, helm-push, k8sgpt, cilium-cli, trivy-operator, zot, helm-docs, zarf, cert-manager-cmctl, rancher-fleet, k8ssandra-client, k9s, kargo, chartmuseum, flux-helm-controller, kots, pluto, helm-operator,...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, consul-k8s, consul-k8s-fips, pluto, chart-testing, zot, trivy-fips, helm-push, kots, flux-source-controller, flux-helm-controller-fips, helm-operator, zarf, tw, harbor, cilium-cli, kubescape, chartmuseum, flux-helm-controller, kuma,...