CLEANSTART-2026-OE12981 Security fix for CVE-2026-49834 applied in: cosign 3.1.1-r2, cosign 3.1.2-r1, harbor-trivy-adapter-fips 0.36.0-r1, kyverno 1.17.2-r2, kyverno 1.18.1-r2, policy-controller-fips 0.15.1-r1, spire-server 1.14.7-r0, spire-server-fips 1.15.1-r1, tekton-chains 0.25.2-r1, tekton-chains 0.26.5-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1

CVE-2026-49834 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

GO-2024-2737 vulnerabilities

Vulnerabilities for packages: helm-push, wolfictl, dagger, harbor-scanner-trivy-fips, syft, melange, cri-tools, neuvector-scanner, grype, buf, policy-controller, policy-controller-fips, docker-compose, harbor-scanner-trivy, k3d, kaniko...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: skaffold, spire-server, wolfictl, neuvector-sigstore-interface, slsa-verifier, aactl, apko, policy-controller, falcoctl-fips, falcoctl, flux-source-controller, vexctl, gitsign, spire-server-fips, ko-fips, tekton-chains-fips, melange, tkn-fips, ko, tekton-chains,...

CLEANSTART-2026-HT07063 Security fixes in policy-controller-fips 0.15.1-r0

Package policy-controller-fips version 0.15.1-r0 fixes 5 vulnerabilities: CVE-2026-34986, CVE-2026-39984, ghsa-pmwq-pjrm-6p5r, ghsa-78h2-9frx-2jm8, ghsa-xm5m-wgh2-rrg3...

GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities

Vulnerabilities for packages: tflint-fips, neuvector-sigstore-interface, ratify-fips, aactl, kubescape-server-fips, image-factory-fips, tbot, policy-controller, trivy-fips, kyverno-notation-aws-fips, falcoctl-fips, kyverno-notation-aws, falcoctl, trivy-operator-fips, zarf-fips, cloudbeat, gitsign...

CLEANSTART-2026-YQ26872 Security fixes for CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2026-1229, CVE-2026-24051, CVE-2026-34986, CVE-2026-39984, ghsa-78h2-9frx-2jm8, ghsa-pmwq-pjrm-6p5r, ghsa-xm5m-wgh2-rrg3 applied in versions: 0.13.1-r0, 0.15.1-r0

Multiple security vulnerabilities affect the policy-controller-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-keycloak-fips, aactl, kubevela-fips, crossplane-provider-keycloak, packer-fips, omni-fips, crossplane-provider-aws-cognitoidentity, policy-controller, crossplane-provider-aws-sqs, boring-registry, terragrunt-fips,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: k3d, prometheus-postgres-exporter, dgraph, certificate-transparency-fips, configmap-reload, falcosidekick, grafana-operator-fips, conftest-fips, skopeo, crossplane-provider-azure-sql, syft, tkn, kube-bench-fips, temporal-ui-server-fips, flux-image-reflector-controlle...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: skaffold, dagger, slsa-verifier, aactl, cosign, policy-controller, newrelic-infrastructure-agent, flux-image-reflector-controller, falcoctl-fips, bom, k3d, k3s, scorecard, helm-fips, kpt, falcoctl, helm-operator, flux-helm-controller, vexctl, ctop, cadvisor-fips, lok...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: skaffold, dagger, slsa-verifier, aactl, cosign, policy-controller, newrelic-infrastructure-agent, flux-image-reflector-controller, falcoctl-fips, bom, k3d, k3s, scorecard, helm-fips, kpt, falcoctl, helm-operator, flux-helm-controller, vexctl, ctop, cadvisor-fips, lok...