GO-2026-5052 vulnerabilities

Vulnerabilities for packages: traefik, traefik-fips, crossplane-provider-azure-portal, crossplane-provider-azure-resources, nfpm, crossplane-provider-azure-network, external-secrets-operator-fips, goreleaser, crossplane-provider-azure-policyinsights, x509-certificate-exporter,...

GO-2026-5224 vulnerabilities

Vulnerabilities for packages: rancher, cloudbeat, authentik, vault, cloudbeat-fips, azure-service-operator-fips, vault-fips, rancher-agent, azure-service-operator, authentik-fips...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gomplate, pulumi-language-yaml, teleport, flux-source-controller-fips, kubevela, kyverno, argo-cd, grafana-alloy-fips, kaniko-fips, nuclei, trivy-operator, guac, dagger, cloudbeat-fips, rancher-fleet, livekit-cli, wolfictl, chezmoi, argo-cd-fips,...

GO-2025-4245 vulnerabilities

Vulnerabilities for packages: k8sgateway, nrdot-collector-k8s-fips, eks-distro-fips, vale, amazon-cloudwatch-agent, coredns-fips, rke2-runtime, opentelemetry-collector-fips, grafana-alloy, argo-workflows, argo-cd, nats, keda-fips, grafana-alloy-fips, elastic-agent, tempo, aws-otel-collector-fips,...

GO-2023-2102 vulnerabilities

Vulnerabilities for packages: gomplate, slsa-verifier, pulumi-language-yaml, chartmuseum, prometheus-statsd-exporter-fips, rqlite, kubevela, trillian, dynamic-localpv-provisioner, tekton-chains, nats, fuse-overlayfs-snapshotter, src, aws-efs-csi-driver, prometheus-alertmanager,...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: kaniko, flux-source-controller, gomplate, slsa-verifier, zarf, pulumi-language-yaml, flux-image-automation-controller, goreleaser, crossplane-provider-aws-sns, kubevela, skaffold, gitsign, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-ec2,...

GO-2026-5005 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, traefik-fips, calico-fips, knative-kafka-broker-fips, istio, frankenphp-8.5, kyverno, podman, argo-cd, docker-cli-buildx-fips, nerdctl, etcd-fips, etcd, omnictl-multiarch, elastic-agent-fips, kine, kube-arangodb-fips, gitlab-kas, harbor,...

GO-2026-4971 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-scheduler-fips, crossplane-provider-azure-portal, calico-fips, crossplane-provider-terraform-fips, k8s-metacollector-fips, flux-source-controller-fips, aws-privateca-issuer-fips, crossplane-function-environment-configs-fips,...

GO-2025-3487 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, terraform-provider-azurerm, calico-fips, flux-source-controller-fips, crossplane-provider-aws-sns, crossplane-provider-aws-cloudwatchlogs, trillian, promxy-fips, velero-fips, kubernetes-dashboard-api, temporal-server, opentelemetry-operator...

GO-2025-3420 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, vgpu-util, calico-fips, flux-source-controller-fips, aws-privateca-issuer-fips, fluent-operator, dataplaneapi-fips, trillian, docker-credential-ecr-login-fips, promxy-fips, velero-fips, kubernetes-dashboard-api, temporal-server, wave-fips,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, terraform-provider-azurerm, protoc-gen-go, fluent-operator, dataplaneapi-fips, trillian, velero-fips, wave-fips, fuse-overlayfs-snapshotter, ytt, prometheus-alertmanager, crane, litestream, cilium-fips, nri-mysql, azure-aad-pod-identity-mic...

GO-2026-4947 vulnerabilities

Vulnerabilities for packages: buildah, envoy-ratelimit, nfs-subdir-external-provisioner, spire-server, tetragon, vault-env, vault-secrets-webhook, rancher-telemetry, mongodb-kubernetes-operator, kubernetes-csi-livenessprobe, sftpgo-plugin-eventsearch, step-ca, falco-no-driver, vault-benchmark,...

Malicious code in @onereach/regular-expressions-test (npm)

npm/@onereach/regular-expressions-test is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

Malicious code in @servicetitan/assist-utils (npm)

npm/@servicetitan/assist-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11632 Malicious code in @onereach/si-code (npm)

npm/@onereach/si-code is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11910 Malicious code in @servicetitan/onboarding-ui (npm)

npm/@servicetitan/onboarding-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: spire-server, wolfictl, zarf, argo-cd, kyverno, pulumi, rancher-machine, gitlab-runner, k3s, dagger, grype, telegraf, rootlesskit, pulumi-kubernetes-operator, kots, flux-image-automation-controller, prometheus-operator, pulumi-language-java, splunk-otel-collector,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: flux, containerd, spire-server, osv-scanner, aactl, knative-serving, gitea, zarf, kyverno, cilium-cli, argocd-image-updater, snyk-cli, prometheus, kubescape, loki, zot, external-dns, gitlab-kas, trivy-operator, istio, k3s, kaf, minio, cilium, mattermost, fscrypt,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: spire-server, wolfictl, zarf, argo-cd, kyverno, pulumi, rancher-machine, gitlab-runner, k3s, dagger, grype, telegraf, rootlesskit, pulumi-kubernetes-operator, kots, flux-image-automation-controller, prometheus-operator, pulumi-language-java, splunk-otel-collector,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: flux, containerd, spire-server, osv-scanner, aactl, knative-serving, gitea, zarf, kyverno, cilium-cli, argocd-image-updater, snyk-cli, prometheus, kubescape, loki, zot, external-dns, gitlab-kas, trivy-operator, istio, docker-machine-driver-harvester, k3s, kaf, minio,...