GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kubernetes, kwok, gatekeeper, cert-manager, cloud-provider-gcp-cloud-controller-manager, cilium, gitlab-kas, k3s, cluster-api-ipam-provider-in-cluster, rancher-system-agent, kapp-controller, metrics-server, openfga, telegraf, hubble, metallb, datadog-operator,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: mailpit-fips, fscrypt, pgtimetable, terraform-provider-azurerm-fips, victoriametrics-operator, crossplane-provider-aws-schemas, grpcurl-fips, apiserver-network-proxy, timestamp-authority-fips, linkerd2-cni-plugin, flux-notification-controller, vexctl, spegel-fips,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: goreleaser, scorecard, gitness, pulumi-language-yaml, nuclei, apko, pulumi-kubernetes-operator, gomplate, zot, kots, go-licenses, bom, gitsign, kubevela, src-fingerprint, pulumi, pulumi-language-java, pulumi-language-dotnet, flux-kustomize-controller...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: sops, age-fips, litestream, ksops, flux-kustomize-controller-fips, age, chezmoi, grafana-fips, sops-fips, grafana, flux-kustomize-controller...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: syft, dynamic-localpv-provisioner, secrets-store-csi-driver-fips, kube-metrics-adapter, istio-pilot-agent, conftest, docker-compose, fscrypt, sigstore-scaffolding, kube-fluentd-operator, crossplane-provider-azure, helm-operator-fips, flux-source-controller,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: gitsign, gitea, dagger, argo-events, k9s, grafana-alloy, argocd-image-updater, pulumi-language-java, flux, guac, trivy, flux-image-automation-controller, kaniko, gptscript, chezmoi, kubescape, pulumi-kubernetes-operator, go-licenses, k8sgpt, kargo, kots,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: gitsign, gitea, dagger, argo-events, k9s, grafana-alloy, argocd-image-updater, pulumi-language-java, flux, guac, trivy, flux-image-automation-controller, kaniko, gptscript, chezmoi, kubescape, pulumi-kubernetes-operator, go-licenses, k8sgpt, kargo, kots,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: up, wal-g, fluent-bit-plugin-loki, hugo, argo-events, boring-registry, grafana-agent-operator, sigstore-scaffolding, ksops, buildkitd, tekton-chains, falcoctl, trino, flux, bank-vaults, guac, sops, opentelemetry-collector-contrib, trivy, sqlpad,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: litestream, ksops, flux-kustomize-controller, sops, chezmoi, age...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, fluent-bit-plugin-loki, govulncheck, kubeflow-katib, victoriametrics-cluster, kubescape-operator, nri-prometheus, cert-manager, k9s, kiali, node-problem-detector, sftpgo-plugin-geoipfilter, amazon-k8s-cni, continuity,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: cloudflared, gitsign, oauth2-proxy, aactl, tekton-chains, vexctl, sops, terragrunt, dex, kubescape, cosign, kots, fulcio, spire-server, slsa-verifier, rekor, flux-kustomize-controller, argo-workflows, flux-source-controller, tkn...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: cloudflared, cert-manager, k9s, kubernetes-dashboard, hcloud, crossplane-provider-aws-elasticache, crossplane-provider-aws-lambda, nfpm, docker-cli-buildx, minio, tw, fscrypt, crossplane-provider-azure-authorization, rootlesskit, terragrunt, argo-cd,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: govulncheck, kubeflow-katib, pgtimetable, kubescape-operator, rancher-system-upgrade-controller, whereabouts, boring-registry, rancher-system-agent, rabbitmq-default-user-credential-updater, sftpgo-plugin-geoipfilter, kyverno-policy-reporter-ui, kubernetes-dashboard,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure, gitsign, aactl, argo-events, k3s, opentelemetry-collector, glab, sigstore-scaffolding, ksops, crossplane-provider-azure-sql, buildkitd, falcoctl, tekton-chains, crossplane-provider-family-azure, vexctl, flux, bank-vaults,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: cert-manager, k9s, kubernetes-dashboard, hcloud, nfpm, docker-cli-buildx, minio, fscrypt, crossplane-provider-azure-authorization, rootlesskit, terragrunt, argo-cd, flux-image-automation-controller, eksctl, gptscript, podman, policy-controller, chezmoi, steampipe,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: syft, gogatekeeper, knative-eventing, conftest, sigstore-scaffolding, grpcurl-fips, nginx-kubernetes-ingress, flux-source-controller, distribution, timestamp-authority-fips, commercial-chainloop-cli, vexctl, nerdctl, cloudbeat, envconsul-fips, kube-arangodb, restic,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: k9s, boring-registry, crossplane-provider-aws-elasticache, crossplane-provider-aws-lambda, kyverno-notation-aws, nfpm, docker-cli-buildx, crossplane-provider-azure-authorization, terragrunt, argo-cd, flux-image-automation-controller, policy-controller, gptscript,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: k9s, boring-registry, crossplane-provider-aws-elasticache, crossplane-provider-aws-lambda, kyverno-notation-aws, nfpm, docker-cli-buildx, crossplane-provider-azure-authorization, terragrunt, argo-cd, flux-image-automation-controller, policy-controller, gptscript,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitness, syft, trivy-operator, crossplane-provider-aws-ecr-fips, kyverno-notation-aws, crossplane-provider-aws-sns, gitea-fips, tfsec, trufflehog-fips, crossplane-provider-aws-ecr, tekton-pipelines, atlantis-fips, apko, docker-cli-buildx,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...