GO-2026-5694 vulnerabilities

Vulnerabilities for packages: zot, ratify, kyverno, aactl, teleport, kubescape, trivy-operator, kyverno-notation-aws, policy-controller, trivy, slsa-verifier, crossplane...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: tekton-chains, kubescape, kyverno-notation-aws, aactl, tkn, kyverno, teleport, gitsign, trivy-operator, spire-server, ratify, tflint, neuvector-sigstore-interface, goreleaser, ko, zarf, crossplane, policy-controller, falcoctl, slsa-verifier...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: flux-source-controller, tekton-chains, melange, kubescape, policy-controller, spire-server, skaffold, apko, ko, cosign, slsa-verifier, aactl, tkn...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lambda, terragrunt, containerd, external-dns, step-kms-plugin, crossplane-provider-aws-s3, nfpm, podman, crossplane-provider-aws-cloudwatchlogs, docker-compose, eksctl, prometheus-operator, gptscript, aactl, tw, kyverno,...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: tekton-chains, kubescape, kyverno-notation-aws, vexctl, aactl, tkn, kyverno, teleport, gitsign, spire-server, flux-source-controller, zot, ratify, tflint, neuvector-sigstore-interface, goreleaser, ko, gh, zarf, crossplane, policy-controller, skaffold, falcoctl,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: tekton-chains, kubescape, kyverno-notation-aws, trivy, vexctl, aactl, tkn, docker, kyverno, teleport, gitsign, trivy-operator, spire-server, flux-source-controller, zot, ratify, tflint, neuvector-sigstore-interface, goreleaser, ko, gh, zarf, crossplane,...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: flux-source-controller, zot, ratify, witness, kyverno, teleport, gitsign, kyverno-notation-aws, policy-controller, goreleaser, falcoctl, aactl, tkn...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: tekton-chains, kubescape, kyverno-notation-aws, trivy, vexctl, aactl, tkn, docker, kyverno, teleport, gitsign, trivy-operator, spire-server, flux-source-controller, zot, ratify, rekor, tflint, neuvector-sigstore-interface, goreleaser, ko, gh, zarf, crossplane,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, tekton-chains, opentelemetry-collector, terragrunt, snyk-cli, opentelemetry-collector-contrib, fulcio, kubescape, gomplate, crossplane-provider-azure, flux, crossplane-provider-azure-managedidentity, kubevela, terraform, vexctl, aactl, tkn,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: tekton-chains, kubescape, vexctl, aactl, tkn, gitsign, spire-server, wolfictl, flux-source-controller, zot, neuvector-sigstore-interface, goreleaser, apko, ko, zarf, melange, policy-controller, skaffold, falcoctl, slsa-verifier...

RockyLinux 8 : bind9.16 (RLSA-2026:54509)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54509 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

PT-2026-72119

OpenStack Octavia through 18.0.0 mishandles quality of service QoS policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected...

AlmaLinux 8 : bind9.16 (ALSA-2026:54509)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54509 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-133...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-72676

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

CVE-2026-72630

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-72630

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

EUVD-2026-58290

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

CVE-2026-72676

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...