GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cluster-api-gcp-controller, crossplane, cluster-api, kuma, external-secrets-operator, calico, kube-rbac-proxy, grafana, metallb, kubernetes-csi-external-health-monitor, cloud-provider-aws, azure-service-operator, cert-manager-istio-csr,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation-fips, opentelemetry-collector-contrib-fips, gcp-compute-persistent-disk-csi-driver, grafana, vertical-pod-autoscaler, kube-state-metrics, livekit-cli, crossplane-provider-aws-cloudwatchlogs, aws-ebs-csi-driver, kube-arangodb-fip...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: kots, pulumi-language-yaml, pulumi-language-java, zot, gitsign, scorecard, gomplate, goreleaser, pulumi, flux-kustomize-controller, bom, gitness, nuclei, src-fingerprint, go-licenses, pulumi-language-dotnet, apko, pulumi-kubernetes-operator, kubevela...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: age, sops-fips, sops, age-fips, grafana-fips, grafana, ksops, flux-kustomize-controller, flux-kustomize-controller-fips, chezmoi, litestream...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, buildkitd-fips, gcp-compute-persistent-disk-csi-driver, portieris-fips, grafana, kube-state-metrics, crossplane-provider-aws-cloudwatchlogs, fluent-bit-plugin-loki, flannel, tekton-chains, mailpit, spicedb, seaweedfs,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: crossplane, gitsign, kaniko, timoni, apko, argo-events, pulumi-language-java, src-fingerprint, pulumi-language-yaml, zarf, trivy, osv-scanner, flux-kustomize-controller, kargo, kubevela, scorecard, grype, melange, zot, argo-workflows, pulumi-kubernetes-operator, flux...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: crossplane, gitsign, kaniko, timoni, apko, argo-events, pulumi-language-java, src-fingerprint, pulumi-language-yaml, zarf, trivy, osv-scanner, flux-kustomize-controller, kargo, kubevela, scorecard, grype, melange, zot, argo-workflows, pulumi-kubernetes-operator, flux...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, airflow, sigstore-scaffolding, argo-events, fulcio, grafana-agent-operator, prometheus-operator, thanos, ksops, tkn, trivy, zarf, step, flux-kustomize-controller, py3-cassandra-medusa, buildkitd, sops, wal-g, zot, argo-workflows, flux,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: age, sops, chezmoi, ksops, litestream, flux-kustomize-controller...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, cluster-api, crossplane-provider-aws-route53, ctop, terraform-provider-acme, kubo, tofu-controller, sftpgo-plugin-pubsub, docker-machine-driver-harvester, tekton-pipelines, kube-vip, chisel, crossplane-provider-azure-managedidentity, ksops,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: gitsign, fulcio, tkn, flux-kustomize-controller, sops, argo-workflows, kubescape, flux-source-controller, aactl, terragrunt, spire-server, tekton-chains, kots, slsa-verifier, oauth2-proxy, cloudflared, rekor, vexctl, cosign, dex...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, terraform-provider-acme, apko, go-discover, external-dns, prometheus-operator, chisel, crossplane-provider-azure-managedidentity, ksops, pulumi-language-yaml, zarf, osv-scanner, flux-kustomize-controller, crossplane-provider-aws-s3,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: ctop, kuberlr, kubo, tofu-controller, sftpgo-plugin-pubsub, yace, external-dns, lvm-driver, chisel, ksops, osv-scanner, vale, flux-kustomize-controller, crossplane-provider-aws-s3, scorecard, blobfuse2, gke-gcloud-auth-plugin, kubernetes-replicator, rancher-telemetry...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: glab, gitsign, crossplane-provider-azure-authorization, opentelemetry-collector, sigstore-scaffolding, argo-events, flux-notification-controller, fulcio, terraform-provider-azurerm, crossplane-provider-azure, crossplane-provider-azure-managedidentity, ksops, gomplate...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: apko, docker-machine-driver-harvester, go-discover, external-dns, prometheus-operator, chisel, crossplane-provider-azure-managedidentity, ksops, pulumi-language-yaml, zarf, osv-scanner, flux-kustomize-controller, caddy, scorecard, containerd, grype, zot,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, cg, vault-csi-provider-fips, opentofu-fips, grafana, livekit-cli, gitlab-kas-fips, kube-arangodb-fips, tekton-chains, livekit-server-fips, spicedb, seaweedfs, grype-db, headlamp, spiffe-helper, kubo, omni, harbor-registry-fips,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: cluster-api, crossplane-provider-aws-route53, apko, crossplane-provider-azure-managedidentity, ksops, pulumi-language-yaml, zarf, osv-scanner, flux-kustomize-controller, crossplane-provider-aws-s3, kubevela, scorecard, grype, zot, crossplane-provider-aws-elasticache,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: cluster-api, crossplane-provider-aws-route53, apko, crossplane-provider-azure-managedidentity, ksops, pulumi-language-yaml, zarf, osv-scanner, flux-kustomize-controller, crossplane-provider-aws-s3, kubevela, scorecard, grype, zot, crossplane-provider-aws-elasticache,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, crossplane-provider-aws-cloudformation-fips, crossplane-provider-azure-storage, cg, kubescape-server-fips, buildkitd-fips, snyk-cli, gitea, terragrunt, opentofu-fips, grafana, kyverno-fips, rancher-fleet, helm-diff, trivy-fips,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...