GHSA-W67G-5RQW-F597 vulnerabilities

Vulnerabilities for packages: loki-fips, etcd-fips, gpu-operator, eks-distro-fips, juicefs-csi-driver, longhorn-engine, cloudflared, amazon-ssm-agent, guac, cosmo-router-fips, plutono-fips, prometheus, loki, amazon-ssm-agent-fips, redis-operator-fips, infinispan-operator, etcd, prometheus-fips,...

GHSA-J2G6-362Q-6QC6 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws-fips, velero-plugin-for-gcp-fips, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-microsoft-azure, velero-plugin-for-aws, velero-plugin-for-gcp...

GO-2026-5052 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-netapp, crossplane-provider-azure-resources, crossplane-provider-azure-authorization, crossplane-provider-azure-powerbidedicated, crossplane-provider-azure-security, crossplane-provider-azure-synapse, crossplane-provider-azure-web, grafana,...

GO-2026-5224 vulnerabilities

Vulnerabilities for packages: azure-service-operator, cloudbeat, azure-service-operator-fips, authentik-fips, vault-fips, authentik, rancher-agent, rancher, vault, cloudbeat-fips...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: cerbos, cerbos-fips, rancher-fleet-fips, argo-cd, kargo, commercial-chainloop-cli, crossplane, skaffold, trivy, flux-source-controller-fips, kubescape, argo-events-fips, trivy-fips, cloudbeat, packer-fips, steampipe, chainctl, k9s-fips, pulumi-language-java,...

GO-2025-4245 vulnerabilities

Vulnerabilities for packages: aws-otel-collector, kubeflow-pipelines, aws-otel-collector-fips, nrdot-collector-k8s-fips, k8sgpt, eks-distro-fips, opentelemetry-collector, argo-cd, eks-distro, datadog-agent, jaeger-fips, kargo, tempo, elastic-agent, elastic-agent-fips, opentelemetry-collector-fips...

GO-2023-2102 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, secrets-store-csi-driver, dynamic-localpv-provisioner-fips, secrets-store-csi-driver-provider-gcp, crossplane-provider-aws, kind, newrelic-infrastructure-agent, prometheus-node-exporter-fips, kubeflow-katib, runc, haproxy-ingress, skaffol...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: zot, crossplane-provider-aws-iam, crossplane-provider-aws-eks, crossplane-provider-aws-cloudformation, sops, crossplane-provider-aws-elasticache, terragrunt, spire-server-fips, crossplane-provider-aws, crossplane-provider-aws-sqs, kaniko, crossplane,...

GO-2026-5005 vulnerabilities

Vulnerabilities for packages: knative-eventing-fips, omnictl-multiarch-fips, vault-fips, cilium, gitlab-kas, commercial-expanso-edge, argo-cd, traefik-fips, tekton-pipelines, aactl, cert-manager, prometheus-elasticsearch-exporter, grafana-fips, omnictl-multiarch, opentofu-fips, helm, fscrypt, kin...

GO-2026-4971 vulnerabilities

Vulnerabilities for packages: google-guest-agent-manager, litefs, local-static-provisioner-fips, crossplane-provider-aws-rolesanywhere-fips, rootlesskit-fips, vault-fips, kubernetes-csi-external-resizer-fips, crossplane-provider-azure-spring, prometheus-redis-exporter-fips, kuberay-operator-fips,...

GO-2025-3487 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, google-guest-agent-manager, local-static-provisioner-fips, vcluster, crossplane, grpc-health-probe, actions-runner-controller, flux-source-controller-fips, spqr, src, atlantis, agentbeat-fips, nri-mssql, vexctl, prometheus-podman-exporter...

GO-2025-3420 vulnerabilities

Vulnerabilities for packages: litefs, local-static-provisioner-fips, kubernetes-csi-external-resizer-fips, prometheus-redis-exporter-fips, kuberay-operator-fips, kind, speedtest-go, sqlexporter-fips, runc, grpc-health-probe, actions-runner-controller, flux-source-controller-fips,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, litefs, prometheus-redis-exporter-fips, kind, speedtest-go, vcluster, runc, grpc-health-probe, actions-runner-controller, harbor-scanner-trivy-fips, spqr, mage, src, metacontroller, gobump, atlantis, chainctl, nri-mssql, metallb, vexctl,...

GO-2026-4947 vulnerabilities

Vulnerabilities for packages: paranoia, k8sgpt-operator, mkcert, grafana-operator, wave, cerbos, terraform-provider-pagerduty, wal-g, cosign, step, mc, opencost, dbmate, kubernetes-event-exporter, spegel, configmap-reload, gke-gcloud-auth-plugin, crossplane-provider-azure-managedidentity,...

Malicious code in @onereach/regular-expressions-test (npm)

npm/@onereach/regular-expressions-test is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

Malicious code in @servicetitan/assist-utils (npm)

npm/@servicetitan/assist-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11632 Malicious code in @onereach/si-code (npm)

npm/@onereach/si-code is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11910 Malicious code in @servicetitan/onboarding-ui (npm)

npm/@servicetitan/onboarding-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: kots, wal-g, pulumi-kubernetes-operator, k3s, zarf, gitlab-kas, terragrunt, melange, grype, scorecard, trivy-operator, pulumi-language-dotnet, trivy, nfpm, snyk-cli, cilium, cilium-cli, external-secrets-operator, kaf, nuclei, splunk-otel-collector, podman, osv-scanne...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: kots, kyverno, osv-scanner, spire-server, k9s, kubernetes-dashboard, k3s, cloud-provider-aws, zarf, gitlab-kas, prometheus-operator, skaffold, rancher, flux-source-controller, kubernetes, fscrypt, flux-image-automation-controller, flux, external-dns,...