GO-2026-6094 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, kyverno-notation-aws, hubble-ui, grafana, kapp-controller, kyverno, openbao, k3s, rancher-system-agent, pulumi-kubernetes-operator, cluster-api-azure-controller, flux-kustomize-controller, kubescape, gitlab-kas, spqr, caddy,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: harvester-fips, scorecard, bento, kyverno-policy-reporter, terraform-provider-databricks, crossplane-provider-aws-connect, crossplane-provider-aws-transcribe-fips, kubedock-fips, calico, kserve-fips, kubernetes-dns-node-cache-fips, nri-apache, ops-agent, kwok,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: goreleaser, pulumi-kubernetes-operator, pulumi-language-dotnet, scorecard, pulumi-language-yaml, gitsign, go-licenses, bom, gitness, pulumi, src-fingerprint, flux-kustomize-controller, pulumi-language-java, apko, zot, gomplate, kubevela, kots, nuclei...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: sops-fips, age-fips, ksops, grafana, litestream, sops, flux-kustomize-controller-fips, age, chezmoi, flux-kustomize-controller...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: skaffold, cert-manager-cmctl, scorecard, kyverno-policy-reporter, prometheus-adapter, kubernetes-dashboard, helm-docs, k3d, tekton-chains, temporal-ui-server, external-secrets-fips, vexctl, fulcio-fips, calico, velero-fips, crossplane-provider-azure-storage,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: osv-scanner, tfsec, argo-workflows, pulumi, gptscript, bom, grype, wolfictl, goreleaser, guac, pulumi-kubernetes-operator, kubescape, flux-kustomize-controller, gitsign, flux, chezmoi, syft, zarf, k9s, skaffold, kargo, flux-source-controller, scorecard,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: osv-scanner, tfsec, argo-workflows, pulumi, gptscript, bom, grype, wolfictl, goreleaser, guac, pulumi-kubernetes-operator, kubescape, flux-kustomize-controller, gitsign, flux, chezmoi, syft, zarf, k9s, skaffold, kargo, flux-source-controller, scorecard,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: argo-workflows, rclone, cosign, pulumi, cortex, goreleaser, py3-azure-identity, opentelemetry-collector-contrib, guac, harbor-registry, fluent-bit-plugin-loki, fulcio, kubescape, flux-kustomize-controller, prometheus-operator, py3-cassandra-medusa, rook, trino, flux,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: sops, ksops, chezmoi, litestream, flux-kustomize-controller, age...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: argo-workflows, cosign, oauth2-proxy, fulcio, kubescape, flux-kustomize-controller, gitsign, dex, flux-source-controller, tkn, vexctl, rekor, slsa-verifier, terragrunt, kots, spire-server, sops, tekton-chains, cloudflared, aactl...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, external-secrets-operator, conjur-cli, hubble-ui, haproxy-ingress, neuvector-dbgen, cert-exporter, omnibump, dask-gateway, conftest, ingress-nginx-controller, k3s, kyverno-policy-reporter-kyverno-plugin, kubescape,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, external-secrets-operator, tflint, cosign, wolfictl, go-discover, k3s, fulcio, cluster-api-azure-controller, flux-kustomize-controller, kubescape, gitlab-kas, atlantis, crossplane-provider-azure-authorization, zarf, kubernetes-dashboard,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: tfsec, conjur-cli, helm-set-status, hubble-ui, cosign, terraform-provider-pagerduty, dask-gateway, conftest, ingress-nginx-controller, ferretdb, doppler-kubernetes-operator, k3s, flux-kustomize-controller, kyverno-policy-reporter-kyverno-plugin,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: cosign, pulumi, goreleaser, opentelemetry-collector-contrib, guac, k3s, fulcio, pulumi-kubernetes-operator, kubescape, flux-kustomize-controller, gitsign, rook, flux, crossplane-provider-azure-authorization, rabbitmq-messaging-topology-operator, grafana-mimir,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: external-secrets-operator, tflint, cosign, wolfictl, go-discover, k3s, fulcio, cluster-api-azure-controller, flux-kustomize-controller, kubescape, gitlab-kas, atlantis, crossplane-provider-azure-authorization, zarf, kubernetes-dashboard, rootlesskit, step, act,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: skaffold, kube-arangodb-fips, scorecard, bento, commercial-chainloop-backend, kyverno-policy-reporter, trufflehog-fips, tekton-chains, k3d, buildah-fips, temporal-ui-server, external-secrets-fips, rook-fips, vexctl, fulcio-fips, velero-fips, reports-server,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, tfsec, rclone, terraform-provider-pagerduty, wolfictl, kubescape, flux-kustomize-controller, q, atlantis, crossplane-provider-azure-authorization, xeol, zarf, lazygit, ksops, rancher-fleet, src-fingerprint, nuclei, cilium-cli,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, tfsec, rclone, terraform-provider-pagerduty, wolfictl, kubescape, flux-kustomize-controller, q, atlantis, crossplane-provider-azure-authorization, xeol, zarf, lazygit, ksops, rancher-fleet, src-fingerprint, nuclei, cilium-cli,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: skaffold, argo-workflows-fips, cert-manager-cmctl, amazon-ssm-agent-fips, crossplane-provider-aws-sns-fips, hydra-fips, snyk-cli, terraform-provider-databricks-fips, scorecard, terraform-provider-pagerduty-fips, gitea-fips, terraform-provider-databricks,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...