GO-2023-1793 vulnerabilities

Vulnerabilities for packages: vault-csi-provider, secrets-store-csi-driver...

GO-2023-1793 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: cosign, pulumi, rekor, trivy, flux-image-reflector-controller, chezmoi, flux, flyte, fulcio, kubescape, opentelemetry-collector, buildkitd, nuclei, bank-vaults, py3-cassandra-medusa, grafana-agent-operator, up, tempo, guac, tkn, falcoctl, py3-azure-identity,...

GO-2026-4982 vulnerabilities

Vulnerabilities for packages: conftest, nerdctl, grafana-alloy, sftpgo-plugin-eventstore, flyte, istio, redpanda, juicefs, k3s, kuma, secrets-store-csi-driver, terraform-provider-acme, dbmate, helm, mesosphere-vsphere-csi, kubernetes-csi-node-driver-registrar, zot, apko, jitsucom-bulker,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: amass, cosign, conftest, docker-credential-ecr-login, actions-runner-controller, crossplane-provider-aws-ec2, nerdctl, opensearch-k8s-operator, stakater-reloader, gitleaks, swagger, litefs, juicefs, k3s, bank-vaults, calico, kuma,...

CLEANSTART-2026-OT46541 Security fixes in secrets-store-csi-driver-fips 1.6.0-r1

Package secrets-store-csi-driver-fips version 1.6.0-r1 fixes 5 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-41178, CVE-2026-42505, CVE-2026-39822...

CLEANSTART-2026-FP92201 Security fixes in secrets-store-csi-driver-provider-gcp 1.15.0-r1

Package secrets-store-csi-driver-provider-gcp version 1.15.0-r1 fixes 21 vulnerabilities: CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: kwok, cosign, opensearch-k8s-operator, actions-runner-controller, stakater-reloader, rancher-fleet, litefs, docker, pluto, nodetaint, vexctl, terraform-provider-acme, cluster-api-aws-controller, nri-postgresql, vitess, nri-kubernetes, kubernetes-csi-external-resizer,...

CVE-2026-46700

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws, mountpoint-s3-csi-driver, actions-runner-controller, dgraph, stakater-reloader, flux-image-reflector-controller, flux, aws-network-policy-agent, dkron, external-secrets-operator, metacontroller, polaris,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: buildkitd, cass-operator-fips, skaffold-fips, k6-operator-fips, eck-operator-fips, flux-notification-controller-fips, grype, packer-fips, cloud-provider-aws, apm-server, coredns-fips, tflint-fips, ansible-operator-fips, conftest-fips, policy-controller-fips,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: go-bindata, cass-operator-fips, kubo, nri-mysql-fips, wire-go, crossplane-provider-aws-dynamodb, falco-no-driver, k6-operator-fips, kratos, agentbeat-fips, kind, eck-operator-fips, xeol, flux-image-reflector-controller, flux-notification-controller-fips, git-sync,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: go-bindata, cass-operator-fips, kubo, nri-mysql-fips, wire-go, crossplane-provider-aws-dynamodb, falco-no-driver, k6-operator-fips, kratos, agentbeat-fips, kind, eck-operator-fips, xeol, flux-image-reflector-controller, flux-notification-controller-fips, git-sync,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: nri-mysql-fips, cass-operator-fips, kubo, crossplane-provider-aws-dynamodb, falco-no-driver, k6-operator-fips, agentbeat-fips, kind, eck-operator-fips, xeol, flux-image-reflector-controller, flux-notification-controller-fips, git-sync, grype, minio-object-browser-fip...

Information Disclosure

sigs.k8s.io/secrets-store-sync-controller is vulnerable to Information Disclosure. The vulnerability is due to improper error handling and service account tokens being logged during parameter marshaling errors, and attackers with log access can use these tokens to retrieve secrets from cloud vaul...

EUVD-2023-1539

Malicious code in bioql PyPI...

EUVD-2022-0837

Malicious code in bioql PyPI...

EUVD-2022-2051

Malicious code in bioql PyPI...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: kube-vip-cloud-provider, secrets-store-csi-driver-provider-aws, docker-credential-ecr-login, sftpgo-plugin-pubsub, hivemind, kubeflow-katib, bank-vaults, terraform-provider-time, grafana-operator, newrelic-fluent-bit-output, checksec, local-path-provisioner, vexctl,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, nemo, mattmoor-chainit, docker-credential-ecr-login, mongodb-kubernetes-operator, cloud-provider-aws, kserve-rest-proxy, consul-fips, prometheus-node-exporter-fips, confluent-common-docker, newrelic-nri-statsd, terraform-provider-sendgrid-fips, git-lf...