CLEANSTART-2026-YN35176 Security fixes for CVE-2026-34986 applied in versions: 1.5.1-r0

Security vulnerability affects the rekor-fips package. This issue is resolved in later releases. See references for vulnerability details...

GHSA-FPHV-W9FQ-2525 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding-fips, falcoctl-fips, policy-controller, skaffold-fips, image-factory, policy-controller-fips, falcoctl, kyverno, spire-server, tkn, trivy-operator, buildkitd, trivy, gitsign, tekton-chains, cloudbeat-fips, rekor-fips, witness, vexctl, tflint-fips...

CVE-2026-23992 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding-fips, falcoctl-fips, policy-controller, skaffold-fips, image-factory, policy-controller-fips, falcoctl, kyverno, spire-server, tkn, trivy-operator, buildkitd, trivy, gitsign, tekton-chains, cloudbeat-fips, rekor-fips, witness, vexctl, tflint-fips...

GHSA-846P-JG2W-W324 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding-fips, falcoctl-fips, policy-controller, skaffold-fips, image-factory, policy-controller-fips, falcoctl, kyverno, spire-server, tkn, trivy-operator, buildkitd, trivy, gitsign, tekton-chains, cloudbeat-fips, rekor-fips, witness, vexctl, tflint-fips...

CVE-2026-23991 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding-fips, falcoctl-fips, policy-controller, skaffold-fips, image-factory, policy-controller-fips, falcoctl, kyverno, spire-server, tkn, trivy-operator, buildkitd, trivy, gitsign, tekton-chains, cloudbeat-fips, rekor-fips, witness, vexctl, tflint-fips...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2, prometheus-nats-exporter, pulumi-language-yaml, prometheus-elasticsearch-exporter-fips, fq, temporal, cloud-provider-aws, hugo-fips, crossplane, gitea, crossplane-provider-aws-cloudfront, dagger, cosign-fips, crossplane-provider-azure,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: prometheus-nats-exporter, prometheus-redis-exporter, shfmt, prometheus-elasticsearch-exporter-fips, fq, temporal, nri-nginx, dagger, cosign-fips, go-md2man, crossplane-provider-azure, opa, terraform, kube-vip-fips, slsa-verifier, cass-operator-fips-no-pvc-delete,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2, prometheus-nats-exporter, prometheus-redis-exporter, pulumi-language-yaml, prometheus-elasticsearch-exporter-fips, temporal, crossplane, crossplane-provider-aws-cloudfront, dagger, cosign-fips, crossplane-provider-azure, terraform,...