GHSA-7WWX-XJ66-R44X vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, shfmt, ip-masq-agent, flannel-fips, vertical-pod-autoscaler-fips, kube-metrics-adapter-fips, cilium-fips, etcd, kyverno-policy-reporter-plugins-kyverno-fips, cluster-api-helm-controller-fips, kubeflow-katib,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, shfmt, ip-masq-agent, flannel-fips, vertical-pod-autoscaler-fips, kube-metrics-adapter-fips, cilium-fips, etcd, kyverno-policy-reporter-plugins-kyverno-fips, cluster-api-helm-controller-fips, kubeflow-katib,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, shfmt, ip-masq-agent, flannel-fips, vertical-pod-autoscaler-fips, kube-metrics-adapter-fips, cilium-fips, etcd, kyverno-policy-reporter-plugins-kyverno-fips, cluster-api-helm-controller-fips, kubeflow-katib,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, ip-masq-agent, flannel-fips, vertical-pod-autoscaler-fips, kube-metrics-adapter-fips, cilium-fips, etcd, kyverno-policy-reporter-plugins-kyverno-fips, cluster-api-helm-controller-fips, kubeflow-katib, velero-plugin-for-csi-fips,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, shfmt, ip-masq-agent, flannel-fips, vertical-pod-autoscaler-fips, kube-metrics-adapter-fips, cilium-fips, etcd, kyverno-policy-reporter-plugins-kyverno-fips, cluster-api-helm-controller-fips, kubeflow-katib,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, ip-masq-agent, flannel-fips, vertical-pod-autoscaler-fips, kube-metrics-adapter-fips, cilium-fips, etcd, kyverno-policy-reporter-plugins-kyverno-fips, cluster-api-helm-controller-fips, kubeflow-katib, velero-plugin-for-csi-fips,...

EUVD-2022-3043

Malicious code in bioql PyPI...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, ip-masq-agent, kube-metrics-adapter-fips, cilium-fips, etcd, loki-fips, containerd-fips, ksops, caddy, amazon-cloudwatch-agent, dex-fips, glab, kube-vip-fips, cluster-api-helm-controller-fips, kubeflow-katib,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: cri-tools, kube-logging-operator, controller-gen, dex, oras, prometheus-alertmanager, speedtest-go, nri-mongodb, vite, up, wait-for-port, prometheus-operator, argo-workflows, fq, lazygit, wire-go, dagger, memcached-exporter, nats, vt-cli, vexctl, golangci-lint,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: falcoctl, dex, sops, octo-sts, argo-workflows, istio, apko, rekor, dagger, kyverno-notation-aws, vexctl, splunk-otel-collector, distribution, trivy, policy-controller, skopeo, cosign, openbao, grpc-health-probe, trufflehog, gitsign, dagdotdev, kube-rbac-proxy, ko,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: flux-source-controller, gitsign, gatus, grpc-health-probe, dgraph, rabbitmq-messaging-topology-operator, cilium-fips, openbao-fips, kubescape, containerd-fips, sftpgo, undock, ksops, caddy, tkn-fips, dex-fips, flux-kustomize-controller, steampipe, fulcio-fips,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: falcoctl, dex, sops, octo-sts, argo-workflows, istio, apko, rekor, dagger, kyverno-notation-aws, vexctl, splunk-otel-collector, distribution, trivy, policy-controller, skopeo, cosign, openbao, grpc-health-probe, trufflehog, gitsign, dagdotdev, kube-rbac-proxy, ko,...

CVE-2022-24877

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

GHSA-32GQ-X56H-299C vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller-fips, ksops, litestream, grafana, chezmoi, sops, grafana-fips, age-fips, flux-kustomize-controller, age, sops-fips...

GO-2022-0260 Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller

Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller...

OPENSUSE-SU-2024:13299-1 kustomize-5.1.1-1.1 on GA media

These are all security issues fixed in the kustomize-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: external-dns, falcoctl, fulcio, nuclei, grafana-mimir, sops, opentelemetry-collector-contrib, flux-kustomize-controller, ksops, py3-cassandra-medusa, rclone, grafana-agent-operator, kubescape, up, k8sgpt, step-ca, prometheus-operator, argo-workflows, tekton-chains,...

BIT-KUSTOMIZE-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

BIT-KUSTOMIZE-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, ip-masq-agent, crossplane-provider-aws-rds, etcd, caddy, cass-operator-fips, dex-fips, terraform-provider-google, kubeflow-katib, src, sonobuoy, prometheus-postgres-exporter-fips, ctop, aws-load-balancer-controller, kpt,...