GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-snapshotter, spicedb, kube-rbac-proxy, cloud-provider-gcp-cloud-controller-manager, kube-vip-cloud-provider, cluster-api, kubernetes, flux-helm-controller, metrics-server, cluster-api-azure-controller, zot, tetragon, kubescape, grafana,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: cert-exporter-fips, backup-restore-operator, gcp-compute-persistent-disk-csi-driver, tekton-chains-fips, openbao, crossplane-provider-aws-workspaces-fips, volcano-fips, crossplane-provider-aws-secretsmanager-fips, cadence, fortio,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: scorecard, apko, pulumi, gitness, src-fingerprint, pulumi-language-java, gomplate, kots, nuclei, gitsign, pulumi-language-dotnet, zot, pulumi-language-yaml, goreleaser, pulumi-kubernetes-operator, flux-kustomize-controller, bom, go-licenses, kubevela...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, grafana-fips, ksops, flux-kustomize-controller-fips, sops-fips, grafana, age-fips, sops, litestream, age, chezmoi...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, cert-exporter-fips, neuvector, boring-registry, gcp-compute-persistent-disk-csi-driver, tekton-chains-fips, nfs-subdir-external-provisioner-fips, helm-operator, openbao, wolfictl, docker-compose, neuvector-sigstore-interface, vexctl, ksop...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: gitea, flux, grype, kargo, trivy, gitsign, chezmoi, syft, flux-kustomize-controller, skaffold, wolfictl, src-fingerprint, grafana-alloy, go-licenses, k9s, apko, zot, osv-scanner, argo-workflows, kubescape, flux-image-automation-controller, pulumi-language-yaml, dagge...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: gitea, flux, grype, kargo, trivy, gitsign, chezmoi, syft, flux-kustomize-controller, skaffold, wolfictl, src-fingerprint, grafana-alloy, go-licenses, k9s, apko, zot, osv-scanner, argo-workflows, kubescape, flux-image-automation-controller, pulumi-language-yaml, dagge...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: harbor-registry, flux, rekor, airflow, ksops, sqlpad, flyte, tempo, hugo-extended, restic, terragrunt, tkn, grafana-mimir, trivy, chezmoi, thanos, up, sigstore-scaffolding, flux-kustomize-controller, rclone, bank-vaults, druid, timestamp-authority, trino,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: litestream, ksops, age, sops, chezmoi, flux-kustomize-controller...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, volume-modifier-for-k8s, kube-logging-operator-custom-runner, flyte, kubernetes-csi-external-snapshotter, terragrunt, ctop, kubernetes-event-exporter, q, sftpgo-plugin-pubsub, azcopy, fuse-overlayfs-snapshotter,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: rekor, tkn, terragrunt, vexctl, gitsign, flux-kustomize-controller, dex, tekton-chains, sops, argo-workflows, kubescape, cloudflared, oauth2-proxy, spire-server, kots, cosign, flux-source-controller, aactl, slsa-verifier, fulcio...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-iam, kargo, terragrunt, tflint, trivy, external-dns, crossplane-provider-aws-s3, helm, syft, kubernetes, traefik, cluster-api-azure-controller, zot, crossplane-provider-aws-cloudfront,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, volume-modifier-for-k8s, whereabouts, kube-logging-operator-custom-runner, crossplane-provider-aws-iam, mesosphere-vsphere-csi, secrets-store-csi-driver-provider-aws, ctop, kubernetes-event-exporter, maru, sftpgo-plugin-pubsub,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, flux, rekor, kargo, k3s, ksops, tkn, terragrunt, vexctl, kubernetes-event-exporter, grafana-mimir, gitsign, actions-runner-controller, sigstore-scaffolding, flux-kustomize-controller, src-fingerprint, bank-vaults, gomplate,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: kargo, terragrunt, tflint, trivy, external-dns, helm, syft, kubernetes, cluster-api-azure-controller, zot, kubescape, flux-image-automation-controller, glab, spire-server, cosign, rancher, pulumi-language-dotnet, flux-source-controller, istio, loki, guac, nuclei, ko,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: neuvector, boring-registry, tekton-chains-fips, openbao, wolfictl, neuvector-sigstore-interface, istio, vexctl, ksops, opentofu-fips, sigstore-scaffolding-fips, kaniko-fips, neuvector-scanner, gitlab-runner-fips, seaweedfs-fips, zot, cilium, xeol-fips, vault-benchmar...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-iam, terragrunt, trivy, q, helm, crossplane-provider-aws-s3, syft, cluster-api, ratify, flux-helm-controller, zot, argo-workflows, crossplane-provider-aws-cloudfront, flux-image-automation-controller,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-iam, terragrunt, trivy, q, helm, crossplane-provider-aws-s3, syft, cluster-api, ratify, flux-helm-controller, zot, argo-workflows, crossplane-provider-aws-cloudfront, flux-image-automation-controller,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: argo-events-fips, crossplane-provider-aws-eks, crossplane-provider-family-azure, pulumi, boring-registry, openbao, cert-manager-cmctl, crossplane-provider-aws-cognitoidentity-fips, crossplane-provider-aws-eks-fips, crossplane-provider-aws-route53-fips, wolfictl,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...