kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the...

kube-linter

Statische Analyse für Kubernetes Was ist KubeLinter? KubeLinter analysiert Kubernetes-YAML-Dateien, Helm-Charts und Kustomize-Manifeste und prüft sie anhand einer Vielzahl von Best Practices, mit dem Schwerpunkt auf Produktionsreife und Sicherheit. KubeLinter führt sinnvolle Standardprüfungen...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cert-manager, kots, openbao, metrics-server, cloud-provider-aws, cloud-provider-vsphere, opentelemetry-operator, kubernetes-csi-external-provisioner, spicedb, openfga, cloud-provider-azure, zot, descheduler, helm-operator, cloud-provider-gcp-cloud-controller-manager,...

CVE-2026-76229

A flaw was found in Renovate. This arbitrary command injection vulnerability exists within the kustomize manager, where user-provided chart names are not properly sanitized before being used in helm pull commands. An attacker with write access to a repository can exploit this by crafting maliciou...

CVE-2026-76229

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

EUVD-2026-62470

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229

Renovate (dependency update bot) versions from 39.218.9 (March 26, 2025) before 40.33.0 contain an arbitrary command injection in the kustomize manager . The depName argument passed to the helmRepositoryArgs function in lib/modules/manager/kustomize/artifacts.ts is not escaped using shlex.quote b...

PT-2026-78411

Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: k8sgateway, kube-oidc-proxy, kubernetes-dashboard-metrics-scraper-fips, amass, redis-operator-fips, spegel-fips, databricks-cli, controller-gen, terraform-provider-random-fips, grpcurl-fips, spiffe-helper, terraform-provider-databricks, ko-fips, hubble-ui,...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, zitadel, karma, telegraf, cosmo-router, karma-fips...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, zitadel, karma, telegraf, cosmo-router, karma-fips...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, zitadel, karma, telegraf, cosmo-router, karma-fips...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: gomplate, pulumi-kubernetes-operator, kots, bom, gitness, apko, src-fingerprint, gitsign, nuclei, pulumi-language-dotnet, goreleaser, scorecard, flux-kustomize-controller, kubevela, go-licenses, zot, pulumi-language-yaml, pulumi-language-java, pulumi...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: helm-push, metacontroller, k8sgateway, aws-node-termination-handler-fips, xeol, kube-oidc-proxy, nats-top-fips, spqr, kubernetes-dashboard-metrics-scraper-fips, mockgen, kubernetes-csi-driver-nfs, amass, aws-s3-controller, cert-manager-webhook-pdns,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: helm-push, metacontroller, aws-node-termination-handler-fips, kube-oidc-proxy, nats-top-fips, spqr, kubernetes-dashboard-metrics-scraper-fips, mockgen, amass, aws-s3-controller, cert-manager-webhook-pdns, kube-state-metrics-fips, etcd-fips, influxd, pguser, gosu-fips...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: helm-push, metacontroller, aws-node-termination-handler-fips, kube-oidc-proxy, nats-top-fips, spqr, kubernetes-dashboard-metrics-scraper-fips, mockgen, amass, aws-s3-controller, cert-manager-webhook-pdns, kube-state-metrics-fips, etcd-fips, influxd, pguser, gosu-fips...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: chezmoi, grafana, flux-kustomize-controller, ksops, flux-kustomize-controller-fips, litestream, grafana-fips, sops-fips, age-fips, sops, age...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: helm-push, spqr, tflint, amass, cert-manager-webhook-pdns, minio-operator, kube-state-metrics-fips, sftpgo-plugin-pubsub, etcd-fips, zarf, seaweedfs, prometheus-operator, x509-certificate-exporter, hugo, opentelemetry-collector, spiffe-helper, q, thanos-fips,...