GO-2026-6094 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, tekton-chains, k3s, tekton-pipelines, cert-manager-istio-csr, cloud-provider-gcp-cloud-controller-manager, flux-notification-controller, node-feature-discovery, cilium, cluster-api-helm-controller, grafana, rancher-agent,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: cosign-fips, helm-operator, crossplane-provider-aws-lightsail-fips, flagger, teleport-operator-fips, nri-rabbitmq-fips, virt-controller-fips, gitlab-runner-operator-fips, crossplane-provider-aws-wafv2-fips, steampipe, step-kms-plugin, crossplane-provider-aws-acm-fips...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: src-fingerprint, kubevela, go-licenses, pulumi-language-java, pulumi-language-dotnet, gitsign, zot, apko, goreleaser, gomplate, pulumi-kubernetes-operator, kots, flux-kustomize-controller, pulumi, pulumi-language-yaml, gitness, nuclei, bom, scorecard...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: grafana-fips, flux-kustomize-controller-fips, grafana, sops-fips, ksops, litestream, age, chezmoi, age-fips, sops, flux-kustomize-controller...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: temporal-server, argo-cd, cosign-fips, crossplane-provider-aws-kms, seaweedfs, helm-operator, kwok, secrets-store-csi-driver, rancher-fleet, terraform-provider-sendgrid-fips, harbor-registry, cert-manager-cmctl, portieris-fips, etcd-fips, trillian-fips, zot,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, task, snyk-cli, kaniko, dagger, pulumi, go-licenses, grype, kubevela, k8sgpt, chezmoi, k9s, osv-scanner, src-fingerprint, kubescape, argo-workflows, guac, apko, pulumi-kubernetes-operator, kargo, tfsec, crossplane, wolfictl, argo-events, gitsign...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, task, snyk-cli, kaniko, dagger, pulumi, go-licenses, grype, kubevela, k8sgpt, chezmoi, k9s, osv-scanner, src-fingerprint, kubescape, argo-workflows, guac, apko, pulumi-kubernetes-operator, kargo, tfsec, crossplane, wolfictl, argo-events, gitsign...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: tekton-chains, hugo, grafana-agent-operator, harbor-registry, rekor, sigstore-scaffolding, sqlpad, fluent-bit-plugin-loki, pulumi, falcoctl, prometheus-operator, tkn, k8sgpt, chezmoi, up, velero, trino, fulcio, kubescape, argo-workflows, guac, druid, cortex,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: ksops, flux-kustomize-controller, chezmoi, age, litestream, sops...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: tekton-chains, oauth2-proxy, rekor, vexctl, tkn, slsa-verifier, fulcio, kubescape, argo-workflows, dex, gitsign, aactl, spire-server, sops, cosign, flux-kustomize-controller, flux-source-controller, terragrunt, kots, cloudflared...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: db-operator, pulumi-language-java, traefik, vcluster, crossplane-provider-family-aws, crossplane-provider-aws-sns, harbor-registry, tekton-pipelines, snyk-cli, grafana, terraform-provider-grafana, tetragon, rancher-agent, continuity, container-object-storage-interfac...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, traefik, crossplane-provider-family-aws, crossplane-provider-aws-sns, docker, snyk-cli, rancher-agent, pulumi, crossplane-provider-aws-firehose, grype, podman, cert-manager, tkn, k8sgpt, fulcio, rootlesskit, datadog-agent, falco-no-driver,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: db-operator, ghaudit, traefik, crossplane-provider-family-aws, aws-eks-pod-identity-agent, crossplane-provider-aws-sns, harbor-registry, kubernetes-dashboard-api, wuzz, terraform-provider-time, tetragon, terraform-provider-pagerduty, container-object-storage-interfac...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: tekton-chains, k3s, crossplane-provider-azure-authorization, neuvector-sigstore-interface, flux-notification-controller, rekor, sigstore-scaffolding, terraform, snyk-cli, crossplane-provider-azure, vexctl, pulumi, actions-runner-controller, falcoctl, kubevela, k3d,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: pulumi-language-java, docker, snyk-cli, rancher-agent, pulumi, grype, podman, cert-manager, tkn, k8sgpt, fulcio, rootlesskit, datadog-agent, falco-no-driver, external-secrets-operator, kubescape, guac, apko, pulumi-kubernetes-operator, glab, eksctl, policy-controller...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: temporal-server, argo-cd, cosign-fips, seaweedfs, migrate, teleport-operator-fips, teleport, gotrue, harbor-registry, trillian-fips, zot, podman-fips, steampipe, step-kms-plugin, tekton-chains-fips, nerdctl, hydra, trivy-operator-fips, argo-workflows-fips, caddy-fips...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: pulumi-language-java, vcluster, crossplane-provider-family-aws, crossplane-provider-aws-sns, docker, grafana, snyk-cli, terraform-provider-pagerduty, pulumi, crossplane-provider-aws-firehose, grype, datadog-agent, kubescape, guac, apko, pulumi-kubernetes-operator,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, vcluster, crossplane-provider-family-aws, crossplane-provider-aws-sns, docker, grafana, snyk-cli, terraform-provider-pagerduty, pulumi, crossplane-provider-aws-firehose, grype, datadog-agent, kubescape, guac, apko, pulumi-kubernetes-operator,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: argo-cd, crossplane-provider-aws-kms, crossplane-provider-aws-cloudwatchlogs, flux-image-automation-controller-fips, trivy, crossplane-provider-aws-kinesis, livekit-cli, external-secrets-operator-fips, argo-cd-fips, crossplane-provider-aws-eks-fips, rancher-fleet,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...