GO-2025-3488 vulnerabilities

Vulnerabilities for packages: apko, amazon-cloudwatch-agent, flux-image-automation-controller, kubernetes-dns-node-cache, yunikorn-k8shim, src-fingerprint, cert-manager-cmctl-fips, kubernetes-dashboard-auth-fips, nfs-subdir-external-provisioner-fips, authservice, flux, aws-efs-csi-driver-fips,...

GO-2025-3848 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector...

GO-2024-2899 vulnerabilities

Vulnerabilities for packages: pombump, melange...

GO-2026-5337 vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-notation-aws...

GO-2026-4753 vulnerabilities

Vulnerabilities for packages: rancher, rancher-agent, dex, mattermost, teleport...

GO-2024-2948 vulnerabilities

Vulnerabilities for packages: kots, grype, kubescape, tflint, snyk-cli, terragrunt, wolfictl, conftest, zot, zarf, k9s, terraform, trivy, tfsec...

GO-2024-3277 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, aws-efs-csi-driver...

GO-2026-5235 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2024-2609 vulnerabilities

Vulnerabilities for packages: ctop, nri-rabbitmq, cadvisor, kubernetes-csi-external-resizer, nri-elasticsearch, kubernetes-event-exporter, task, metrics-server, govulncheck, memcached-exporter, cni-plugins, gosu, goreleaser, configmap-reload, tailscale, go-licenses, temporal, terraform-docs,...

GO-2026-5074 vulnerabilities

Vulnerabilities for packages: gitea, cerbos, trivy-operator, crossplane, pulumi, snyk-cli, steampipe, goreleaser, witness, zarf, flux-source-controller, argo-cd, external-secrets-operator, src-fingerprint, argo-workflows, trufflehog, grafana-alloy, flux, terragrunt, wolfictl, gitaly, gitlab-runne...

GO-2026-4871 vulnerabilities

Vulnerabilities for packages: cerbos, omnibump, sftpgo-plugin-eventsearch, kubernetes-event-exporter, memcached-exporter, kube-arangodb, snyk-cli, temporal, goreleaser, tailscale, velero-plugin-for-microsoft-azure, cortex, cue, ko, actions-runner-controller, flannel-cni-plugin, gitness, petname,...

GO-2026-4762 vulnerabilities

Vulnerabilities for packages: cerbos, sftpgo-plugin-eventsearch, kubernetes-event-exporter, metrics-server, snyk-cli, kube-arangodb, temporal, goreleaser, velero-plugin-for-microsoft-azure, cortex, ko, gitness, terragrunt, neuvector-sigstore-interface, kubernetes-csi-external-provisioner, hubble,...

GO-2025-3754 vulnerabilities

Vulnerabilities for packages: crossplane-provider-keycloak, snyk-cli, goreleaser, go-licenses, atlantis, src-fingerprint, argo-workflows, actions-runner-controller, gitness, grafana-alloy, rclone, terragrunt, neuvector-sigstore-interface, extism, crossplane-provider-aws,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, metrics-server, memcached-exporter, snyk-cli, temporal, tailscale, src-fingerprint, cortex, ko, actions-runner-controller, flannel-cni-plugin, gitness, petname, terragrunt, rootlesskit, neuvector-sigstore-interface,...

GO-2024-2963 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, metrics-server, memcached-exporter, snyk-cli, temporal, goreleaser, tailscale, src-fingerprint, cortex, cue, ko, actions-runner-controller, flannel-cni-plugin, gitness, petname, terragrunt, rootlesskit, neuvector-sigstore-interface,...

CVE-2026-73420 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse-fips, langfuse...

CLEANSTART-2026-FH61032 Security fixes in metrics-server 0.8.1-r2

Package metrics-server version 0.8.1-r2 fixes 13 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-42154, ghsa-8rm2-7qqf-34qm...

DEBIAN-CVE-2026-68398

In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tprecv runs in the L2TP UDP-encap softirq RX path: l2tpudpencaprecv - l2tprecvcommon - pppol2tprecv - pppinput&po-chan It runs under rcureadlock holding...

Malicious code in ventrix-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b68f964850d0777c1f3993c52e3b66dc425b02ee82fb33bcd958514f730926 [email protected] ships a loader that, when the package's default getPlugin export is invoked, performs an HTTP request to the hardcoded endpoint...

MAL-2026-11706 Malicious code in @or-sdk/library (npm)

npm/@or-sdk/library is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...