GO-2026-5774 vulnerabilities

Vulnerabilities for packages: karma, telegraf, fluxcd-kustomize-mutating-webhook...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: karma, telegraf, fluxcd-kustomize-mutating-webhook...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: karma, telegraf, fluxcd-kustomize-mutating-webhook...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: flux-source-controller, grype, k9s, zarf, dagger, pulumi-language-yaml, flux-image-automation-controller, crossplane, src-fingerprint, wolfictl, kubescape, flux-kustomize-controller, go-licenses, timoni, flux, kargo, kots, syft, gitsign, pulumi-kubernetes-operator,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: flux-source-controller, grype, k9s, zarf, dagger, pulumi-language-yaml, flux-image-automation-controller, crossplane, src-fingerprint, wolfictl, kubescape, flux-kustomize-controller, go-licenses, timoni, flux, kargo, kots, syft, gitsign, pulumi-kubernetes-operator,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flux-source-controller, hugo-extended, tekton-chains, zarf, py3-azure-identity, policy-controller, bank-vaults, boring-registry, thanos, tkn, sqlpad, step-ca, tempo, rekor, kubescape, flux-kustomize-controller, prometheus-operator, flux, sigstore-scaffolding, cortex,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: chezmoi, age, litestream, sops, flux-kustomize-controller, ksops...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, gitlab-runner, prometheus, sealed-secrets, harbor, envconsul, rancher-fleet, zarf, crossplane-provider-aws-sns, fuse-overlayfs-snapshotter, policy-controller, kube-bench, speedtest-go, traefik, trufflehog, bank-vaults, src-fingerprint, croc,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: flux-source-controller, tekton-chains, tkn, rekor, kubescape, flux-kustomize-controller, oauth2-proxy, kots, vexctl, gitsign, slsa-verifier, aactl, argo-workflows, sops, spire-server, terragrunt, cosign, cloudflared, dex, fulcio...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: gitlab-runner, prometheus, sealed-secrets, ko, zarf, crossplane-provider-aws-sns, tw, policy-controller, traefik, kine, step-kms-plugin, neuvector-sigstore-interface, src, cilium-cli, prometheus-operator, podman, cert-manager, kots, openbao, syft, buildah,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: verticadb-operator, gitlab-runner, lvm-driver, sealed-secrets, spire-server, git-lfs, crossplane-provider-aws-sns, fuse-overlayfs-snapshotter, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, traefik, sftpgo-plugin-kms, bank-vaults, boring-registry,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-source-controller, tekton-chains, zarf, policy-controller, flux-image-automation-controller, bank-vaults, src-fingerprint, crossplane-provider-azure, tkn, crossplane-provider-azure-managedidentity, terraform, step-ca, k3d, neuvector-sigstore-interface, kubescape...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.20.6 security update

Important: Red Hat OpenShift GitOps v1.20.6 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-10444 Document as known: GitOps deployment fails as Kustomize 5.8.1 HelmChartInflationGenerator omits SonarQube namespace...

CLEANSTART-2026-WE34008 Security fixes in kustomize 5.7.1-r3

Package kustomize version 5.7.1-r3 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-27137, CVE-2026-25679, CVE-2026-27138...

CLEANSTART-2026-FP54801 Security fixes in kustomize 5.7.1-r1

Package kustomize version 5.7.1-r1 fixes 3 vulnerabilities: CVE-2025-68121, CVE-2025-61732, CVE-2022-3219...

CLEANSTART-2026-GF33583 Security fixes in kustomize-fips 5.7.1-r1

Package kustomize-fips version 5.7.1-r1 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

EUVD-2026-43087

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

CVE-2026-55175

Spinnaker CVE-2026-55175 affects Rosco/Kustomize bake operations where unsafe YAML tag processing in rosco manifests can lead to remote code execution on rosco pods. Affected versions are prior to 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 across release lines; fixes are available in 2026.1.1, 20...

CVE-2026-55175 Spinnaker: Improper yaml processing on kustomize bake operations

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

CVE-2026-55175 Spinnaker: Improper yaml processing on kustomize bake operations

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...