GO-2026-6094 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, cluster-api, kubernetes-csi-external-attacher, cilium, yunikorn-k8shim, datadog-agent, cloud-provider-gcp-cloud-controller-manager, emissary, opentelemetry-operator, openfga, kubernetes-csi-external-snapshotter, hubble-ui, cert-manager,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: jobset-fips, crossplane-provider-aws-codecommit, aws-otel-collector-fips, crossplane-provider-aws-sns-fips, logstash-exporter, crossplane-provider-keycloak-fips, prometheus-node-exporter, vendir-fips, crossplane-provider-aws-appmesh, crossplane-provider-aws-wafv2,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: goreleaser, zot, pulumi-language-java, kubevela, kots, apko, pulumi, src-fingerprint, go-licenses, bom, gitness, nuclei, flux-kustomize-controller, pulumi-language-yaml, gomplate, pulumi-kubernetes-operator, pulumi-language-dotnet, gitsign, scorecard...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: litestream, age, sops-fips, grafana, flux-kustomize-controller, grafana-fips, flux-kustomize-controller-fips, chezmoi, ksops, sops, age-fips...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: spark-operator, prometheus-statsd-exporter, rqlite, crossplane-provider-aws-cloudfront, crossplane-provider-keycloak-fips, prometheus-node-exporter, wireguard-go, vendir-fips, dagdotdev, crossplane-provider-aws-rds, splunk-otel-collector-fips, azuredisk-csi-fips,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: go-licenses, argocd-image-updater, grafana-alloy, pulumi, flux-source-controller, osv-scanner, dagger, pulumi-language-java, wolfictl, argo-workflows, k8sgpt, apko, timoni, zot, pulumi-language-dotnet, scorecard, kubevela, nuclei, chezmoi, zarf, syft, task, k9s,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: go-licenses, argocd-image-updater, grafana-alloy, pulumi, flux-source-controller, osv-scanner, dagger, pulumi-language-java, wolfictl, argo-workflows, k8sgpt, apko, timoni, zot, pulumi-language-dotnet, scorecard, kubevela, nuclei, chezmoi, zarf, syft, task, k9s,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: pulumi, rekor, py3-cassandra-medusa, flux-source-controller, step, up, falcoctl, velero, cosign, ksops, opentelemetry-collector-contrib, step-ca, flux-image-reflector-controller, argo-workflows, grafana-mimir, k8sgpt, zot, grafana-agent-operator, boring-registry,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: sops, flux-kustomize-controller, ksops, chezmoi, litestream, age...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, cluster-api, victoriametrics-cluster, nri-kubernetes, datadog-agent, osv-scanner, nova, kubernetes-event-exporter, src, pulumi-language-java, redpanda, kubescape-operator, containerd, cloud-provider-aws,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: rekor, flux-source-controller, cosign, slsa-verifier, aactl, argo-workflows, oauth2-proxy, vexctl, tkn, dex, kots, sops, kubescape, cloudflared, tekton-chains, flux-kustomize-controller, fulcio, gitsign, spire-server, terragrunt...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: flux-source-controller, datadog-agent, terraform-provider-azapi, osv-scanner, cosign, src, ko, pulumi-language-java, wolfictl, containerd, cloud-provider-aws, teleport, hcloud, scorecard, gitlab-pages, zarf, buildah, falco-no-driver, pulumi-kubernetes-operator, minio...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, dockerize, rabbitmq-messaging-topology-operator, osv-scanner, cosign, kubernetes-event-exporter, src, lvm-driver, kor, lazygit, kubescape-operator, spire-controller-manager, cloud-provider-vsphere, rancher-loglevel, cloud-provider-aws...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, pulumi, rekor, flux-source-controller, gh, falcoctl, cosign, ksops, kubernetes-event-exporter, neuvector-sigstore-interface, opentelemetry-collector-contrib, step-ca, gomplate, flux-image-reflector-controller, slsa-verifier, aact...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux-source-controller, datadog-agent, osv-scanner, cosign, ko, pulumi-language-java, wolfictl, containerd, cloud-provider-aws, teleport, hcloud, scorecard, zarf, buildah, falco-no-driver, pulumi-kubernetes-operator, minio, loki, sops, rancher, wal-g,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: keda-fips, authentik-fips, dagdotdev, spicedb-fips, splunk-otel-collector-fips, tflint-fips, cephcsi-fips, sigstore-scaffolding, trillian-fips, crossplane-provider-terraform-fips, chainctl, trufflehog, falcosidekick-fips, restic-fips, authentik, cloudprober,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: cluster-api, flux-source-controller, datadog-agent, osv-scanner, pulumi-language-java, wolfictl, lazygit, extism, scorecard, zarf, pulumi-kubernetes-operator, sops, gitness, wal-g, src-fingerprint, vcluster, ratify, crossplane-provider-aws-memorydb, docker-cli-buildx...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: cluster-api, flux-source-controller, datadog-agent, osv-scanner, pulumi-language-java, wolfictl, lazygit, extism, scorecard, zarf, pulumi-kubernetes-operator, sops, gitness, wal-g, src-fingerprint, vcluster, ratify, crossplane-provider-aws-memorydb, docker-cli-buildx...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: zot, atlantis-fips, grype-fips, crossplane-provider-aws-sns-fips, src-fingerprint-fips, cloudbeat-fips, crossplane-provider-aws-cloudfront, crossplane-provider-keycloak-fips, terraform-provider-pagerduty-fips, crossplane-provider-aws-kinesis-fips,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...