GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cilium, metallb, cluster-api-gcp-controller, crossplane, yunikorn-k8shim, kube-rbac-proxy, cloud-provider-vsphere, external-secrets-operator, vcluster, tetragon, kots, kube-vip-cloud-provider, azure-service-operator, kwok, cert-manager-webhook-pdns,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: nova, metacontroller, grafana-operator-fips, flux-fips, grafana-rollout-operator, omnictl-multiarch, pluto, terragrunt, dkron, flux-image-automation-controller, flux-source-watcher, temporal-fips, flux-image-reflector-controller, aws-load-balancer-controller-fips,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: buildkitd, splunk-otel-collector, cilium, helm, kubernetes-dashboard, crossplane-provider-aws-eks, src, nuclei, zarf, syft, step-kms-plugin, act, crossplane-provider-aws-kinesis, crossplane-provider-aws-rds, buildah, trivy, external-secrets-operator, trivy-operator,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, kubelet-csr-approver, kuberlr, percona-server-mongodb-operator, nats-top, grafana-operator, pgpool2exporter, kubernetes-dashboard, wuzz, lvm-driver, src, nri-f5, cluster-api-gcp-controller, gitleaks, spire-controller-manager,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: tekton-chains, buildkitd, sigstore-scaffolding, spire-server, flux-kustomize-controller, grafana-mimir, kargo, k3s, gitsign, nuclei, timestamp-authority, pulumi, fulcio, flux, zarf, crossplane-provider-azure-storage, gh, ksops, slsa-verifier, glab, goreleaser,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: grype, pulumi-language-java, boring-registry, argo-events-fips, cloudbeat, kubevela, chainloop-cli-fips, gitsign, external-secrets-operator-fips, grype-fips, grafana, kyverno-fips, guac, argocd-image-updater, jfrog-cli, flux-source-controller, coder,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: grype, pulumi-language-java, boring-registry, argo-events-fips, cloudbeat, kubevela, chainloop-cli-fips, gitsign, external-secrets-operator-fips, grype-fips, grafana, kyverno-fips, guac, argocd-image-updater, jfrog-cli, flux-source-controller, coder,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: grype, pulumi-language-java, boring-registry, argo-events-fips, cloudbeat, kubevela, chainloop-cli-fips, gitsign, external-secrets-operator-fips, grype-fips, grafana, kyverno-fips, guac, argocd-image-updater, jfrog-cli, flux-source-controller, coder,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: grype, pulumi-language-java, boring-registry, argo-events-fips, cloudbeat, kubevela, chainloop-cli-fips, gitsign, external-secrets-operator-fips, grype-fips, grafana, kyverno-fips, guac, argocd-image-updater, jfrog-cli, flux-source-controller, coder,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: argo-workflows, gptscript, gitea, gitlab-runner, k9s, trufflehog, bom, rancher-fleet, kargo, gitsign, nuclei, crossplane, pulumi, flux, syft, tfsec, xeol, kaniko, goreleaser, snyk-cli, act, grafana-alloy, dagger, witness, flux-notification-controller,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: argo-workflows, gptscript, gitea, gitlab-runner, k9s, trufflehog, bom, rancher-fleet, kargo, gitsign, nuclei, crossplane, pulumi, flux, syft, tfsec, xeol, kaniko, goreleaser, snyk-cli, act, grafana-alloy, dagger, witness, flux-notification-controller,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: argo-workflows, gptscript, gitea, gitlab-runner, k9s, trufflehog, bom, rancher-fleet, kargo, gitsign, nuclei, crossplane, pulumi, flux, syft, tfsec, xeol, kaniko, goreleaser, snyk-cli, act, grafana-alloy, dagger, witness, flux-notification-controller,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: argo-workflows, gptscript, gitea, gitlab-runner, k9s, trufflehog, bom, rancher-fleet, kargo, gitsign, nuclei, crossplane, pulumi, flux, syft, tfsec, xeol, kaniko, goreleaser, snyk-cli, act, grafana-alloy, dagger, witness, flux-notification-controller,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: buildkitd, splunk-otel-collector, cilium, helm, kubernetes-dashboard, nuclei, zarf, syft, step-kms-plugin, act, buildah, trivy, external-secrets-operator, trivy-operator, step, external-dns, kots, opentelemetry-collector, fscrypt, nfpm, nerdctl, cosign, terragrunt,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: buildkitd, splunk-otel-collector, cilium, helm, kubernetes-dashboard, crossplane-provider-aws-eks, src, nuclei, zarf, syft, step-kms-plugin, act, crossplane-provider-aws-kinesis, crossplane-provider-aws-rds, buildah, trivy, external-secrets-operator, trivy-operator,...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, node-problem-detector, percona-server-mongodb-operator, dapr, net-kourier, cilium, crossplane-provider-aws-eks, grafana-mimir, gitsign, metallb, cluster-api-gcp-controller, crossplane, newrelic-infrastructure-agent, nuclei,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, node-problem-detector, percona-server-mongodb-operator, dapr, net-kourier, cilium, crossplane-provider-aws-eks, grafana-mimir, gitsign, metallb, cluster-api-gcp-controller, crossplane, newrelic-infrastructure-agent, nuclei,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...