GO-2026-5025 vulnerabilities

Vulnerabilities for packages: kubernetes, helm, crossplane-provider-azure-authorization, k3s, glab, kots, grafana-pyroscope, cilium, gptscript, caddy, hubble, kine, minio, prometheus, step-issuer, kyverno, telegraf, zot, gitea, terraform-provider-acme, crossplane-provider-azure-storage, nerdctl,...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: kubernetes, kubevela, k3s, caddy, buildkitd, prometheus-adapter, up...

GO-2026-5030 vulnerabilities

Vulnerabilities for packages: kubernetes, helm, crossplane-provider-azure-authorization, k3s, glab, kots, grafana-pyroscope, cilium, gptscript, caddy, hubble, kine, minio, prometheus, step-issuer, kyverno, telegraf, zot, gitea, terraform-provider-acme, crossplane-provider-azure-storage, nerdctl,...

GO-2026-5028 vulnerabilities

Vulnerabilities for packages: kubernetes, helm, crossplane-provider-azure-authorization, k3s, glab, kots, grafana-pyroscope, cilium, gptscript, caddy, hubble, kine, minio, prometheus, step-issuer, kyverno, telegraf, zot, gitea, terraform-provider-acme, crossplane-provider-azure-storage, nerdctl,...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: nodetaint, spark-operator, ip-masq-agent, aws-efs-csi-driver, kubernetes-dns-node-cache, prometheus-adapter...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: trillian, prometheus-pushgateway, minio-operator, karma, grafana-pyroscope, loki, minio, minio-object-browser, jaeger, tempo, splunk-otel-collector, telegraf, datadog-agent, mc, aws-otel-collector, mcp-grafana, cloud-sql-proxy, certificate-transparency, istio, keda...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: trillian, metrics-server, prometheus-pushgateway, minio-operator, karma, loki, minio, prometheus, amazon-cloudwatch-agent-operator, jaeger, tempo, splunk-otel-collector, datadog-agent, mc, aws-otel-collector, cloud-sql-proxy, certificate-transparency,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: guac, step-ca, thanos, kubescape, falcoctl, ksops, cosign, trivy, sigstore-scaffolding, trino, pulumi, flyte, rclone, chezmoi, opentelemetry-collector-contrib, goreleaser, velero, zarf, sqlpad, flux-kustomize-controller, harbor-registry, boring-registry, grafana-mimi...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, nri-couchbase, helm, pgpool2exporter, timoni, crossplane-provider-aws-cloudwatchlogs, harbor-scanner-trivy, harbor, litestream, glab, metrics-server, octo-sts, src, runc, croc, manifest-tool,...

GO-2026-5841 vulnerabilities

Vulnerabilities for packages: aactl, k3s, loki, containerd, kine, minio, snyk-cli, nerdctl, kyverno, kaf, prometheus-operator, telegraf, flux, spire-server, k3d, zot, kots...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, helm, scorecard, crossplane-provider-aws-cloudwatchlogs, glab, src, ko, syft, cloud-provider-aws, pulumi, chezmoi, mods, caddy, minio, crossplane-provider-aws-lambda, flux-kustomize-controller,...

GO-2026-4976 vulnerabilities

Vulnerabilities for packages: kubernetes, helm, k3s, kaf, kots, runc, aws-flb-cloudwatch, karma, trino, redka, k8s-device-plugin, cilium, hubble, minio, zarf, prometheus, kube-fluentd-operator, kyverno, datadog-agent, telegraf, zot, argo-cd, kubo, aactl, libnvidia-container, juicefs,...

GO-2026-5005 vulnerabilities

Vulnerabilities for packages: kubernetes, helm, k3s, kaf, kots, gitlab-kas, cloud-provider-aws, external-dns, cilium, loki, kine, minio, prometheus, podman, kyverno, telegraf, zot, buildah, aactl, knative-serving, spire-server, rancher, nerdctl, cilium-cli, istio, containerd, kubernetes-dashboard...

GO-2026-5014 vulnerabilities

Vulnerabilities for packages: kubernetes, helm, k3s, kubescape, trivy, kaf, argocd-image-updater, kots, gitlab-kas, cloud-provider-aws, external-dns, osv-scanner, cilium, loki, kine, minio, prometheus, zarf, kyverno, skaffold, flux-source-controller, flux-image-automation-controller, telegraf, zo...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: ini-file, wire-go, src, ko, headlamp, caddy, kubernetes-csi-external-health-monitor, envconsul, ip-masq-agent, rabbitmq-default-user-credential-updater, terraform-mcp-server, kubernetes-dashboard-web, docker-cli, helm-operator, nova, aws-otel-collector, gobuster,...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: timoni, flyte, chezmoi, minio, terragrunt, vault-benchmark, k8sgpt-operator, terraform-provider-azuread, neuvector-sigstore-interface, kubernetes-dashboard-api, sonobuoy, vcluster, src-fingerprint, sbomqs, gitness, kargo, tflint, lvm-driver, aws-network-policy-agent,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: timoni, nri-couchbase, harbor-scanner-trivy, http-echo, flyte, chezmoi, mods, caddy, flux-kustomize-controller, wuzz, supercronic, mc, gobuster, nri-mongodb, protoc-gen-go-grpc, sbom-scorecard, k8sgpt-operator, terraform-provider-aws, bazelisk,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: timoni, oras, helm, lazygit, scorecard, harbor-scanner-trivy, http-echo, litestream, glab, metrics-server, wire-go, src, runc, croc, ko, volume-modifier-for-k8s, flyte, mods, caddy, vt-cli, crossplane-provider-azure, metacontroller, dynamic-localpv-provisioner,...

CVE-2026-73654 Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPathoperation.key.setnewMetadata, value in...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...