GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cert-manager, kots, openbao, metrics-server, cloud-provider-aws, cloud-provider-vsphere, opentelemetry-operator, kubernetes-csi-external-provisioner, spicedb, openfga, cloud-provider-azure, zot, descheduler, helm-operator, cloud-provider-gcp-cloud-controller-manager,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: k8sgateway, kube-oidc-proxy, kubernetes-dashboard-metrics-scraper-fips, amass, redis-operator-fips, spegel-fips, databricks-cli, controller-gen, terraform-provider-random-fips, grpcurl-fips, spiffe-helper, terraform-provider-databricks, ko-fips, hubble-ui,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: gomplate, pulumi-kubernetes-operator, kots, bom, gitness, apko, src-fingerprint, gitsign, nuclei, pulumi-language-dotnet, goreleaser, scorecard, flux-kustomize-controller, kubevela, go-licenses, zot, pulumi-language-yaml, pulumi-language-java, pulumi...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: chezmoi, grafana, flux-kustomize-controller, ksops, flux-kustomize-controller-fips, litestream, grafana-fips, sops-fips, age-fips, sops, age...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: helm-push, spqr, tflint, amass, cert-manager-webhook-pdns, minio-operator, kube-state-metrics-fips, sftpgo-plugin-pubsub, etcd-fips, zarf, seaweedfs, prometheus-operator, x509-certificate-exporter, hugo, opentelemetry-collector, spiffe-helper, q, thanos-fips,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: flux-source-controller, grype, k9s, zarf, dagger, pulumi-language-yaml, flux-image-automation-controller, crossplane, src-fingerprint, wolfictl, kubescape, flux-kustomize-controller, go-licenses, timoni, flux, kargo, kots, syft, gitsign, pulumi-kubernetes-operator,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: flux-source-controller, grype, k9s, zarf, dagger, pulumi-language-yaml, flux-image-automation-controller, crossplane, src-fingerprint, wolfictl, kubescape, flux-kustomize-controller, go-licenses, timoni, flux, kargo, kots, syft, gitsign, pulumi-kubernetes-operator,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flux-source-controller, hugo-extended, tekton-chains, zarf, py3-azure-identity, policy-controller, bank-vaults, boring-registry, thanos, tkn, sqlpad, step-ca, tempo, rekor, kubescape, flux-kustomize-controller, prometheus-operator, flux, sigstore-scaffolding, cortex,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: chezmoi, age, litestream, sops, flux-kustomize-controller, ksops...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, gitlab-runner, prometheus, sealed-secrets, harbor, envconsul, rancher-fleet, zarf, crossplane-provider-aws-sns, fuse-overlayfs-snapshotter, policy-controller, kube-bench, speedtest-go, traefik, trufflehog, bank-vaults, src-fingerprint, croc,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: flux-source-controller, tekton-chains, tkn, rekor, kubescape, flux-kustomize-controller, oauth2-proxy, kots, vexctl, gitsign, slsa-verifier, aactl, argo-workflows, sops, spire-server, terragrunt, cosign, cloudflared, dex, fulcio...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: gitlab-runner, prometheus, sealed-secrets, ko, zarf, crossplane-provider-aws-sns, tw, policy-controller, traefik, kine, step-kms-plugin, neuvector-sigstore-interface, src, cilium-cli, prometheus-operator, podman, cert-manager, kots, openbao, syft, buildah,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: verticadb-operator, gitlab-runner, lvm-driver, sealed-secrets, spire-server, git-lfs, crossplane-provider-aws-sns, fuse-overlayfs-snapshotter, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, traefik, sftpgo-plugin-kms, bank-vaults, boring-registry,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-source-controller, tekton-chains, zarf, policy-controller, flux-image-automation-controller, bank-vaults, src-fingerprint, crossplane-provider-azure, tkn, crossplane-provider-azure-managedidentity, terraform, step-ca, k3d, neuvector-sigstore-interface, kubescape...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gitlab-runner, prometheus, ko, zarf, policy-controller, kine, step-kms-plugin, neuvector-sigstore-interface, cilium-cli, prometheus-operator, podman, cert-manager, kots, openbao, syft, buildah, cloud-provider-aws, buildkitd, apko, nfpm, knative-serving, gh, glab,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: xeol, kube-oidc-proxy, tflint, zarf, seaweedfs, grafana-mimir-fips, grpcurl-fips, spiffe-helper, thanos-fips, ko-fips, agentbeat-fips, kubo-fips, teleport, percona-server-mongodb-operator, livekit-egress, chainctl, consul-fips, octo-sts, chainloop-cli, task-fips,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitaly, rancher-fleet, zarf, crossplane-provider-aws-sns, cerbos, policy-controller, trufflehog, src-fingerprint, boring-registry, hydra, cilium-cli, terraform-provider-pagerduty, kots, openbao, syft, cert-manager-cmctl, buildkitd, apko, nfpm, ratify,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitaly, rancher-fleet, zarf, crossplane-provider-aws-sns, cerbos, policy-controller, trufflehog, src-fingerprint, boring-registry, hydra, cilium-cli, terraform-provider-pagerduty, kots, openbao, syft, cert-manager-cmctl, buildkitd, apko, nfpm, ratify,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, helm-push, xeol, melange, terraform-provider-pagerduty-fips, crossplane-provider-aws-rds, flux-source-controller, crossplane-provider-aws-route53-fips, gitlab-operator, datadog-agent-fips, docker-fips, rclone-fips,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...