GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, packer, google-osconfig-agent, buildkitd, amazon-ecs-agent, envoy-gateway, dagger, k9s, docker-compose-fips, linkerd2, zarf, livekit-cli, helm-set-status, harvester-fips, kargo, helm-fips, zot, neuvector, scorecard, k3s, spegel, helmfile, rancher,...

CLEANSTART-2026-TS12850 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the helm-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-RD08428 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the helm-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: cluster-api-aws-controller, cortex-fips, azure-workload-identity-webhook, kyverno-policy-reporter, kapp-controller, promxy-fips, cephcsi-fips, azure-service-operator-fips, terraform-provider-azapi, opentelemetry-collector-contrib-fips, nvidia-nsight-compute-12.8,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter, prometheus-alertmanager-fips, frp, pulumi-language-dotnet, tekton-chains, zarf, prometheus-pushgateway-fips, protoc-gen-go-grpc, crossplane-provider-aws-iam, terraform-provider-azurerm, flux-kustomize-controller, prometheus-adapter-fips, k3s,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: helm-operator, timoni, policy-controller, flux-image-reflector-controller, crane, eksctl, kubescape, nerdctl, flux-helm-controller, buildkitd, docker-machine-driver-harvester, dagger, kots, k9s, newrelic-infrastructure-agent, aactl, tekton-chains, zarf, up, bom, flux...