40 matches found
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: cilium, metallb, cluster-api-gcp-controller, crossplane, yunikorn-k8shim, kube-rbac-proxy, cloud-provider-vsphere, external-secrets-operator, vcluster, tetragon, kots, kube-vip-cloud-provider, azure-service-operator, kwok, cert-manager-webhook-pdns,...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: nova, metacontroller, grafana-operator-fips, flux-fips, grafana-rollout-operator, omnictl-multiarch, pluto, terragrunt, dkron, flux-image-automation-controller, flux-source-watcher, temporal-fips, flux-image-reflector-controller, aws-load-balancer-controller-fips,...
GO-2026-5013 vulnerabilities
Vulnerabilities for packages: buildkitd, splunk-otel-collector, cilium, helm, kubernetes-dashboard, crossplane-provider-aws-eks, src, nuclei, zarf, syft, step-kms-plugin, act, crossplane-provider-aws-kinesis, crossplane-provider-aws-rds, buildah, trivy, external-secrets-operator, trivy-operator,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: docker-credential-ecr-login, kubelet-csr-approver, kuberlr, percona-server-mongodb-operator, nats-top, grafana-operator, pgpool2exporter, kubernetes-dashboard, wuzz, lvm-driver, src, nri-f5, cluster-api-gcp-controller, gitleaks, spire-controller-manager,...
GO-2024-2947 vulnerabilities
Vulnerabilities for packages: tekton-chains, buildkitd, sigstore-scaffolding, spire-server, flux-kustomize-controller, grafana-mimir, kargo, k3s, gitsign, nuclei, timestamp-authority, pulumi, fulcio, flux, zarf, crossplane-provider-azure-storage, gh, ksops, slsa-verifier, glab, goreleaser,...
GHSA-QGQ7-7HM3-Q39J vulnerabilities
Vulnerabilities for packages: grype, pulumi-language-java, boring-registry, argo-events-fips, cloudbeat, kubevela, chainloop-cli-fips, gitsign, external-secrets-operator-fips, grype-fips, grafana, kyverno-fips, guac, argocd-image-updater, jfrog-cli, flux-source-controller, coder,...
CVE-2026-71557 vulnerabilities
Vulnerabilities for packages: grype, pulumi-language-java, boring-registry, argo-events-fips, cloudbeat, kubevela, chainloop-cli-fips, gitsign, external-secrets-operator-fips, grype-fips, grafana, kyverno-fips, guac, argocd-image-updater, jfrog-cli, flux-source-controller, coder,...
GHSA-HC8V-WWC9-VGXM vulnerabilities
Vulnerabilities for packages: grype, pulumi-language-java, boring-registry, argo-events-fips, cloudbeat, kubevela, chainloop-cli-fips, gitsign, external-secrets-operator-fips, grype-fips, grafana, kyverno-fips, guac, argocd-image-updater, jfrog-cli, flux-source-controller, coder,...
CVE-2026-71556 vulnerabilities
Vulnerabilities for packages: grype, pulumi-language-java, boring-registry, argo-events-fips, cloudbeat, kubevela, chainloop-cli-fips, gitsign, external-secrets-operator-fips, grype-fips, grafana, kyverno-fips, guac, argocd-image-updater, jfrog-cli, flux-source-controller, coder,...
GHSA-HC8V-WWC9-VGXM vulnerabilities
Vulnerabilities for packages: argo-workflows, gptscript, gitea, gitlab-runner, k9s, trufflehog, bom, rancher-fleet, kargo, gitsign, nuclei, crossplane, pulumi, flux, syft, tfsec, xeol, kaniko, goreleaser, snyk-cli, act, grafana-alloy, dagger, witness, flux-notification-controller,...
GHSA-QGQ7-7HM3-Q39J vulnerabilities
Vulnerabilities for packages: argo-workflows, gptscript, gitea, gitlab-runner, k9s, trufflehog, bom, rancher-fleet, kargo, gitsign, nuclei, crossplane, pulumi, flux, syft, tfsec, xeol, kaniko, goreleaser, snyk-cli, act, grafana-alloy, dagger, witness, flux-notification-controller,...
CVE-2026-71557 vulnerabilities
Vulnerabilities for packages: argo-workflows, gptscript, gitea, gitlab-runner, k9s, trufflehog, bom, rancher-fleet, kargo, gitsign, nuclei, crossplane, pulumi, flux, syft, tfsec, xeol, kaniko, goreleaser, snyk-cli, act, grafana-alloy, dagger, witness, flux-notification-controller,...
CVE-2026-71556 vulnerabilities
Vulnerabilities for packages: argo-workflows, gptscript, gitea, gitlab-runner, k9s, trufflehog, bom, rancher-fleet, kargo, gitsign, nuclei, crossplane, pulumi, flux, syft, tfsec, xeol, kaniko, goreleaser, snyk-cli, act, grafana-alloy, dagger, witness, flux-notification-controller,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: buildkitd, splunk-otel-collector, cilium, helm, kubernetes-dashboard, nuclei, zarf, syft, step-kms-plugin, act, buildah, trivy, external-secrets-operator, trivy-operator, step, external-dns, kots, opentelemetry-collector, fscrypt, nfpm, nerdctl, cosign, terragrunt,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: buildkitd, splunk-otel-collector, cilium, helm, kubernetes-dashboard, crossplane-provider-aws-eks, src, nuclei, zarf, syft, step-kms-plugin, act, crossplane-provider-aws-kinesis, crossplane-provider-aws-rds, buildah, trivy, external-secrets-operator, trivy-operator,...
GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: kube-metrics-adapter, node-problem-detector, percona-server-mongodb-operator, dapr, net-kourier, cilium, crossplane-provider-aws-eks, grafana-mimir, gitsign, metallb, cluster-api-gcp-controller, crossplane, newrelic-infrastructure-agent, nuclei,...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: kube-metrics-adapter, node-problem-detector, percona-server-mongodb-operator, dapr, net-kourier, cilium, crossplane-provider-aws-eks, grafana-mimir, gitsign, metallb, cluster-api-gcp-controller, crossplane, newrelic-infrastructure-agent, nuclei,...
SUSE CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...