io.spinnaker.echo:echo-api-tck (main-312), io.spinnaker.echo:echo-notifications (main-312) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-312)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-312 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-312 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-275), io.spinnaker.echo:echo-notifications (main-275) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-275)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-275 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-275 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.47.2), io.spinnaker.echo:echo-notifications (2.47.2) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.47.2)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.47.2 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-281), io.spinnaker.echo:echo-notifications (main-281) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-281)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-281 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-281 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-308), io.spinnaker.echo:echo-notifications (main-308) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-308)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-308 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-308 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.34.4), io.spinnaker.echo:echo-notifications (2.34.4) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.34.4)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.34.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.34.4 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-304), io.spinnaker.echo:echo-notifications (main-304) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-304)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-304 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-304 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.34.2), io.spinnaker.echo:echo-notifications (2.34.2) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.34.2)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.34.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.34.2 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-325), io.spinnaker.echo:echo-notifications (main-325) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-325)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-325 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-325 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-334), io.spinnaker.echo:echo-notifications (main-334) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-334)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-334 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-334 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (>=2026.0-19, <=2026.0-23), io.spinnaker.echo:echo-notifications (>=2026.0-19, <=2026.0-23) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (>=2026.0-19, <=2026.0-23)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-23 Source cves: CVE-2026-32613 Source advisory: MEND:CVE-2026-32613...

io.spinnaker.echo:echo-api-tck (>=main-272, <=2.47.2), io.spinnaker.echo:echo-notifications (>=main-272, <=2.47.2) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (>=main-272, <=2.47.2)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =2.47.2 Source cves: CVE-2026-32613 Source advisory: MEND:CVE-2026-32613...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

PT-2026-31735

Name of the Vulnerable Software and Affected Versions Flux notification-controller versions prior to 1.8.3 Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of...

CVE-2026-24004 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint

Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of individual Android devices from Fleet...

PT-2026-22115

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.80.1 Description Fleet is open source device management software. A flaw in the Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized...

open62541:fuzz_pubsub_binary: Use-of-uninitialized-value in UA_NetworkMessage_decodePayload

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=6747482494402560 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzpubsubbinary Job Type: libfuzzermsanopen62541 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

CVE-2026-1301

CVE-2026-1301 pertains to o6 Automation GmbH Open62541 (Open62541/Open62541-like builds) where in PubSub with JSON decoding enabled a crafted JSON message can cause a heap-allocated array write beyond bounds before authentication, leading to a process crash and memory corruption. Affected compone...