GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: grype-fips, zot, src-fingerprint, pulumi-language-java, gitea, trufflehog, gptscript, trivy-operator, argo-workflows-fips, gomplate, skaffold, chainloop-cli, argo-workflows, boring-registry, kubescape, amazon-ssm-agent, coder-fips, coder, flux,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: grype-fips, zot, src-fingerprint, pulumi-language-java, gitea, trufflehog, gptscript, trivy-operator, argo-workflows-fips, gomplate, skaffold, chainloop-cli, argo-workflows, boring-registry, kubescape, amazon-ssm-agent, coder-fips, coder, flux,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: grype-fips, zot, src-fingerprint, pulumi-language-java, gitea, trufflehog, gptscript, trivy-operator, argo-workflows-fips, gomplate, skaffold, chainloop-cli, argo-workflows, boring-registry, kubescape, amazon-ssm-agent, coder-fips, coder, flux,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: grype-fips, zot, src-fingerprint, pulumi-language-java, gitea, trufflehog, gptscript, trivy-operator, argo-workflows-fips, gomplate, skaffold, chainloop-cli, argo-workflows, boring-registry, kubescape, amazon-ssm-agent, coder-fips, coder, flux,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: goreleaser, gitea, grafana-alloy, trivy-operator, trivy, crossplane, argocd-image-updater, argo-events, gptscript, pulumi-language-dotnet, kargo, gomplate, syft, k9s, pulumi-language-yaml, scorecard, trufflehog, nuclei, flux-notification-controller, kubescape, grype,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: goreleaser, gitea, grafana-alloy, trivy-operator, trivy, crossplane, argocd-image-updater, argo-events, gptscript, pulumi-language-dotnet, kargo, gomplate, syft, k9s, pulumi-language-yaml, scorecard, trufflehog, nuclei, flux-notification-controller, kubescape, grype,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: goreleaser, gitea, grafana-alloy, trivy-operator, trivy, crossplane, argocd-image-updater, argo-events, gptscript, pulumi-language-dotnet, kargo, gomplate, syft, k9s, pulumi-language-yaml, scorecard, trufflehog, nuclei, flux-notification-controller, kubescape, grype,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: goreleaser, gitea, grafana-alloy, trivy-operator, trivy, crossplane, argocd-image-updater, argo-events, gptscript, pulumi-language-dotnet, kargo, gomplate, syft, k9s, pulumi-language-yaml, scorecard, trufflehog, nuclei, flux-notification-controller, kubescape, grype,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: age, spire-server, trivy-operator, argocd-image-updater, sops, helm, gptscript, syft, gomplate, zarf, scorecard, mattermost, wal-g, aactl, teleport, kine, telegraf, gitlab-runner, terragrunt, hcloud, guac, step-kms-plugin, dagger, flux, kyverno, cosign,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: spire-server, trivy-operator, crossplane-provider-keycloak, crossplane-provider-aws-route53, argocd-image-updater, tw, sops, helm, gptscript, syft, gomplate, zarf, crossplane-provider-aws-cloudwatchlogs, scorecard, traefik, mattermost, wal-g, aactl, teleport,...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: kubo, ingress-nginx-controller, aws-otel-collector, spire-server, goreleaser, kubernetes-csi-node-driver-registrar, temporal, trivy-operator, cortex, linkerd2, crossplane-provider-keycloak, crossplane-provider-aws-route53, kubernetes-csi-external-resizer,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: kubo, ingress-nginx-controller, aws-otel-collector, spire-server, goreleaser, kubernetes-csi-node-driver-registrar, temporal, trivy-operator, cortex, linkerd2, crossplane-provider-keycloak, crossplane-provider-aws-route53, kubernetes-csi-external-resizer,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...