GO-2026-6094 vulnerabilities

Vulnerabilities for packages: tekton-chains, helm-operator, telegraf, cluster-autoscaler, zot, opentelemetry-operator, hubble, kubernetes-csi-external-health-monitor, k3s, datadog-operator, yunikorn-k8shim, kuma, argocd-image-updater, spicedb, gatekeeper, rancher, kubescape-operator,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, librechat, victoriametrics-cluster-fips, victoriametrics, omnictl-multiarch, flux-image-automation-controller, amazon-k8s-cni-fips, flux-source-controller, grafana-fips, localstack, cluster-autoscaler-fips, flux-notification-controller,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, podman, tekton-chains, crossplane-provider-aws-sns, buildah, docker-compose, gitea, crossplane-provider-aws-cloudfront, crossplane-provider-azure-managedidentity, telegraf, mattermost, opentofu, chisel, neuvector-sigstore-interface,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: wave, crossplane-provider-aws-sns, timoni, helm-operator, amass, crossplane-provider-aws-cloudfront, local-path-provisioner, k3d, ferretdb, secrets-store-csi-driver, mattermost, telegraf, nri-mongodb, kubernetes-event-exporter, undock, opentofu, chisel,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, tekton-chains, fulcio, falcoctl, grafana-mimir, flux-image-automation-controller, k3d, crossplane-provider-azure-managedidentity, flux, slsa-verifier, buildkitd, timestamp-authority, kubernetes-event-exporter, gh,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: gomplate-fips, tfsec, argo-workflows, gitaly, upwind-agent, crossplane-fips, kots, cloudbeat, mapotf-fips, pulumi-language-yaml, redpanda-console, grype, src-fingerprint, gitlab-runner-fips, amazon-ssm-agent-fips, syft-fips, kaniko, flux, snyk-cli, mapotf, gitaly-fip...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: gomplate-fips, tfsec, argo-workflows, gitaly, upwind-agent, crossplane-fips, kots, cloudbeat, mapotf-fips, pulumi-language-yaml, redpanda-console, grype, src-fingerprint, gitlab-runner-fips, amazon-ssm-agent-fips, syft-fips, kaniko, flux, snyk-cli, mapotf, gitaly-fip...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: gomplate-fips, tfsec, argo-workflows, gitaly, upwind-agent, crossplane-fips, kots, cloudbeat, mapotf-fips, pulumi-language-yaml, redpanda-console, grype, src-fingerprint, gitlab-runner-fips, amazon-ssm-agent-fips, syft-fips, kaniko, flux, snyk-cli, mapotf, gitaly-fip...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: gomplate-fips, tfsec, argo-workflows, gitaly, upwind-agent, crossplane-fips, kots, cloudbeat, mapotf-fips, pulumi-language-yaml, redpanda-console, grype, src-fingerprint, gitlab-runner-fips, amazon-ssm-agent-fips, syft-fips, kaniko, flux, snyk-cli, mapotf, gitaly-fip...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: steampipe, kots, crossplane, gitea, flux-image-automation-controller, gitaly, syft, flux, grype, scorecard, gomplate, pulumi, flux-notification-controller, pulumi-language-java, skaffold, rancher-fleet, kubescape, argo-events, external-secrets-operator, kyverno,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: steampipe, kots, crossplane, gitea, flux-image-automation-controller, gitaly, syft, flux, grype, scorecard, gomplate, pulumi, flux-notification-controller, pulumi-language-java, skaffold, rancher-fleet, kubescape, argo-events, external-secrets-operator, kyverno,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: steampipe, kots, crossplane, gitea, flux-image-automation-controller, gitaly, syft, flux, grype, scorecard, gomplate, pulumi, flux-notification-controller, pulumi-language-java, skaffold, rancher-fleet, kubescape, argo-events, external-secrets-operator, kyverno,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: steampipe, kots, crossplane, gitea, flux-image-automation-controller, gitaly, syft, flux, grype, scorecard, gomplate, pulumi, flux-notification-controller, pulumi-language-java, skaffold, rancher-fleet, kubescape, argo-events, external-secrets-operator, kyverno,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, podman, tekton-chains, crossplane-provider-aws-sns, buildah, docker-compose, gitea, crossplane-provider-aws-cloudfront, crossplane-provider-azure-managedidentity, telegraf, mattermost, opentofu, chisel, neuvector-sigstore-interface,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: podman, tekton-chains, buildah, gitea, crossplane-provider-azure-managedidentity, telegraf, mattermost, opentofu, chisel, neuvector-sigstore-interface, rancher-machine, glab, prometheus-operator, tflint, loki, zot, k3s, nerdctl, cosign, dagger, kargo, caddy,...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, podman, envoy-ratelimit, tekton-chains, crossplane-provider-aws-sns, buildah, docker-compose, helm-operator, dgraph, crossplane-provider-aws-cloudfront, gitaly, crossplane-provider-azure-managedidentity, ferretdb, cloudprober,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, podman, envoy-ratelimit, tekton-chains, crossplane-provider-aws-sns, buildah, docker-compose, helm-operator, dgraph, crossplane-provider-aws-cloudfront, gitaly, crossplane-provider-azure-managedidentity, ferretdb, cloudprober,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...