GO-2026-6094 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, rancher-webhook, cass-operator, cluster-api-aws-controller, flux-helm-controller, spqr, cluster-autoscaler, kuma, gitlab-kas, cloud-provider-azure, kubernetes-csi-external-health-monitor, kubernetes-csi-external-snapshotter, rancher,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: keda-fips, vexctl, chartmuseum-fips, x509-certificate-exporter-fips, haproxy-ingress, pulumi-language-java, spilo, goldilocks-fips, azuredisk-csi-fips, terraform-provider-sendgrid-fips, crossplane-provider-aws-docdb-fips, harbor, spire-controller-manager,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: gitness, kubevela, gomplate, pulumi-language-dotnet, zot, kots, pulumi-language-java, pulumi, go-licenses, src-fingerprint, flux-kustomize-controller, pulumi-kubernetes-operator, gitsign, nuclei, goreleaser, pulumi-language-yaml, apko, scorecard, bom...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: ksops, age-fips, age, sops, grafana-fips, flux-kustomize-controller-fips, sops-fips, flux-kustomize-controller, chezmoi, grafana, litestream...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: kube-rbac-proxy-fips, argo-workflows-fips, cadvisor-fips, vexctl, chartmuseum-fips, prometheus-pushgateway-fips, x509-certificate-exporter-fips, secrets-store-csi-driver-provider-azure-fips, cert-exporter-fips, haproxy-ingress, pulumi-language-java, litestream,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: goreleaser, chezmoi, go-licenses, k8sgpt, dagger, task, guac, argo-workflows, pulumi-language-yaml, trivy, pulumi-kubernetes-operator, tfsec, zot, melange, argo-events, skaffold, flux-kustomize-controller, pulumi-language-java, grafana-alloy, kaniko,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: goreleaser, chezmoi, go-licenses, k8sgpt, dagger, task, guac, argo-workflows, pulumi-language-yaml, trivy, pulumi-kubernetes-operator, tfsec, zot, melange, argo-events, skaffold, flux-kustomize-controller, pulumi-language-java, grafana-alloy, kaniko,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: buildkitd, py3-azure-identity, falcoctl, wal-g, grafana-mimir, trino, goreleaser, cosign, chezmoi, velero, harbor-registry, sqlpad, k8sgpt, rekor, guac, argo-workflows, trivy, rclone, sops, restic, airflow, py3-cassandra-medusa, boring-registry, fulcio, rook,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: litestream, ksops, chezmoi, flux-kustomize-controller, age, sops...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: cloudflared, cosign, vexctl, oauth2-proxy, rekor, argo-workflows, sops, fulcio, spire-server, flux-kustomize-controller, terragrunt, tekton-chains, aactl, flux-source-controller, slsa-verifier, dex, gitsign, tkn, kots, kubescape...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: libnvidia-container, rancher-webhook, aws-flb-kinesis, cass-operator, cri-tools, jitsucom-bulker, gatus, spqr, cluster-autoscaler, tigera-operator, gitlab-pages, docker-cli-buildx, harbor, newrelic-infra-operator, dynamic-localpv-provisioner, kuma, rekor, sops,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: falcoctl, fscrypt, gatus, k8sgpt, dagger, docker-cli-buildx, gitlab-pages, trivy, sops, gitlab-kas, buildah, sealed-secrets, tflint, crossplane-provider-aws-sqs, argo-events, step, terragrunt, traefik, rancher, pulumi, crossplane-provider-azure-storage, snyk-cli,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: falcosidekick, rancher-system-agent, aws-flb-kinesis, cass-operator, secrets-store-csi-driver-provider-aws, cri-tools, headlamp, gatus, nri-mongodb, timescaledb-parallel-copy, spqr, cluster-autoscaler, git-lfs, newrelic-infra-operator, dynamic-localpv-provisioner,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: buildkitd, rabbitmq-messaging-topology-operator, falcoctl, flux-helm-controller, grafana-mimir, goreleaser, cosign, crossplane-provider-azure-authorization, k3d, vexctl, rekor, guac, kubernetes-event-exporter, pulumi-kubernetes-operator, sops,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: falcoctl, fscrypt, gatus, k8sgpt, dagger, docker-cli-buildx, trivy, sops, gitlab-kas, buildah, tflint, argo-events, step, terragrunt, rancher, pulumi, crossplane-provider-azure-storage, snyk-cli, podman, scorecard, argocd-image-updater, gomplate, nuclei,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: cloudflared-fips, argo-workflows-fips, keda-fips, vexctl, amazon-ssm-agent-fips, commercial-expanso-edge, harbor, agentbeat-fips, loki, commercial-grafana, flyte, kyverno-policy-reporter, spire-controller-manager, kube-arangodb, skopeo-fips, flux-kustomize-controller...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: flux-helm-controller, dagger, docker-cli-buildx, trivy, sops, crossplane-provider-aws-sqs, argo-events, terragrunt, pulumi, crossplane-provider-azure-storage, snyk-cli, argo-rollouts, crossplane-provider-keycloak, scorecard, argocd-image-updater, gomplate, nuclei,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, dagger, docker-cli-buildx, trivy, sops, crossplane-provider-aws-sqs, argo-events, terragrunt, pulumi, crossplane-provider-azure-storage, snyk-cli, argo-rollouts, crossplane-provider-keycloak, scorecard, argocd-image-updater, gomplate, nuclei,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: ksops, argo-workflows-fips, buildkitd, crossplane-provider-aws-kinesis, aactl, gitlab-rails-ce, crossplane-provider-aws-lambda, actions-runner-controller-fips, amazon-ssm-agent-fips, cert-manager-cmctl-fips, image-factory-fips, pulumi-language-java, cilium-cli, cerbo...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...