GO-2022-0493 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, k3d, grpcurl, kubeflow, kind, ctop, dynamic-localpv-provisioner...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: k3d, opa, osv-scanner, spire-server, vcluster, kube-rbac-proxy, cloudnative-pg, sigstore-scaffolding, zarf, gomplate, opentelemetry-collector-contrib, ksops, step-ca, rqlite, grafana-mimir, cilium-cli, melange, certificate-transparency, pulumi-language-dotnet, sops,...

GO-2026-5052 vulnerabilities

Vulnerabilities for packages: nuclei, x509-certificate-exporter, crossplane-provider-azure-storage, crossplane-provider-azure-authorization, splunk-otel-collector, grafana, crossplane-provider-azure-sql, cert-manager, telegraf, crossplane-provider-family-azure, external-secrets-operator,...

GO-2025-4188 vulnerabilities

Vulnerabilities for packages: gostatsd, go-discover, kube-fluentd-operator, docker-credential-gcr, hello-world-golang, aws-flb-firehose, smokescreen, kubeflow, newrelic-nri-statsd, aws-flb-kinesis, terraform-provider-google, neuvector-dbgen, aws-flb-cloudwatch, kpt, php-fpmexporter, sonobuoy,...

GO-2026-5327 vulnerabilities

Vulnerabilities for packages: tetragon, splunk-otel-collector, thanos, terraform-provider-pagerduty, argo-cd, ksops, opentelemetry-collector-contrib, grafana-mimir, bento, kubescape, amazon-cloudwatch-agent, grafana, trufflehog, promxy, cortex, cilium, grafana-pyroscope, hubble, wal-g, weaviate,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flux, spire-server, boring-registry, trino, thanos, tkn, secrets-store-csi-driver-provider-azure, falcoctl, zarf, opentelemetry-collector-contrib, ksops, fluent-bit-plugin-loki, goreleaser, grafana-mimir, rclone, rekor, step-ca, pulumi, flux-kustomize-controller,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: buildah, kyverno-policy-reporter-kyverno-plugin, nfs-subdir-external-provisioner, spire-server, cloud-sql-proxy, tetragon, trino, cloud-provider-azure, delve, polaris, ingress-nginx-controller, actions-runner-controller, zarf, kubo, kubernetes-csi-livenessprobe,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: spire-server, nfs-subdir-external-provisioner, gitsign, actions-runner-controller, kubernetes-event-exporter, step-ca, oauth2-proxy, pulumi, up, vault-k8s, nats, bank-vaults, k3s, src, kubeflow, grype, bom, metrics-server, slsa-verifier, kots, prometheus-adapter,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: buildah, envoy-ratelimit, spire-server, tetragon, vault-secrets-webhook, vault-env, kubernetes-csi-livenessprobe, sftpgo-plugin-eventsearch, step-ca, crossplane-provider-family-aws, vault-benchmark, jaeger, authservice, terraform-provider-tls,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: buildah, spire-server, wolfictl, zarf, argo-cd, kyverno, crossplane-provider-family-aws, vault-benchmark, pulumi, terraform-provider-tls, rancher-machine, gitlab-runner, k3s, src, crossplane-provider-aws-firehose, dagger, docker-compose, grype, telegraf, slsa-verifie...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: croc, kubernetes-dashboard-api, spire-server, osv-scanner, tfsec, aactl, k8sgateway, terraform-provider-pagerduty, ingress-nginx-controller, kubo, rancher-helm, goreleaser, cilium-cli, falco-no-driver, bento, redis-operator, headlamp, thanos-operator,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: gitleaks, kyverno-policy-reporter-kyverno-plugin, nfs-subdir-external-provisioner, spire-server, tetragon, vault-secrets-webhook, rancher-telemetry, ingress-nginx-controller, actions-runner-controller, mongodb-kubernetes-operator, kubo, kubernetes-csi-livenessprobe,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, delve, polaris, gcsfuse, rclone, oauth2-proxy, nri-mysql, swagger, kubernetes-csi-external-health-monitor, kapp, rancher-system-upgrade-controller, docker-cli, nginx-prometheus-exporter, terraform-mcp-server, k3s, src, cis-operator, ini-file,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: spire-server, nfs-subdir-external-provisioner, vault-env, rancher-telemetry, sftpgo-plugin-eventsearch, step-ca, aws-load-balancer-controller, nri-mysql, authservice, kube-metrics-adapter, licenseclassifier, docker-cli, overmind, ratify, kubelet-csr-approver, bom,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: buildah, envoy-ratelimit, nfs-subdir-external-provisioner, spire-server, kubernetes-csi-livenessprobe, step-ca, crossplane-provider-family-aws, aws-load-balancer-controller, nri-mysql, authservice, vault-k8s, kube-metrics-adapter, nats, docker-cli, addon-resizer,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux, k3d, spire-server, aactl, gitsign, glab, crossplane-provider-azure-sql, falcoctl, tkn, actions-runner-controller, zarf, gomplate, vexctl, kubernetes-event-exporter, ksops, opentelemetry-collector-contrib, goreleaser, grafana-mimir, snyk-cli, rekor, step-ca,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, nfs-subdir-external-provisioner, spire-server, kubernetes-csi-livenessprobe, step-ca, crossplane-provider-family-aws, aws-load-balancer-controller, nri-mysql, vault-k8s, nats, docker-cli, addon-resizer, bom, trust-manager, kustomize, rootlesskit,...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73302

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an emailverified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...

CVE-2026-73304

Summary: Budibase prior to 3.39.25 exposed OAuth2 tokens (oauth2.accessToken, oauth2.refreshToken) in user metadata responses. The list endpoint (/api/users/metadata) and the single-user endpoint (/api/users/metadata/:id) return full user profiles without removing these fields, enabling any user ...