GHSA-FHGH-WQ4Q-R37X uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

Summary The sigstore check on metadata.json is gated on the wrong side of the condition. LoadMetadata in internal/config/update.go:81 verifies the bundle only when UNIGETIGNOREMETADATASIGNATURE is non-empty, so in a normal run, where nobody sets that variable, the signature is never checked...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: bank-vaults, rancher-security-scan, beats, jitsucom-bulker, gitlab-cng-fips, grafana-fips, neuvector-sigstore-interface-fips, gitlab-cng, k9s-fips, zitadel, kyverno, boring-registry-fips, grafana, istio-fips, beats-fips, mattermost-fips, ratify-fips, pluto-fips,...

GO-2026-4358 vulnerabilities

Vulnerabilities for packages: spire-server-fips, sigstore-scaffolding-fips, neuvector-sigstore-interface, tflint-fips, policy-controller-fips, prometheus-podman-exporter-fips, sigstore-scaffolding, kyverno-policy-reporter-plugins-kyverno-fips, podman, flux-source-controller, chainctl, gh, telepor...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: image-factory-fips, tkn-fips, teleport-operator-fips, ko, tekton-chains, policy-controller, spire-server-fips, falcoctl-fips, sigstore-scaffolding-fips, neuvector-sigstore-interface, kyverno-notation-aws, kubescape, rekor-fips, tflint-fips, cloudbeat-fips,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: tekton-chains, policy-controller, spire-server-fips, wolfictl, falcoctl-fips, sigstore-scaffolding-fips, neuvector-sigstore-interface, kubescape, policy-controller-fips, sigstore-scaffolding, slsa-verifier, aactl, flux-source-controller,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dex, ferretdb, terraform-provider-google, kargo, hubble-ui, spire-server, cloudnative-pg, spicedb, cilium-cli, temporal, kots, opentelemetry-collector, certificate-transparency, cert-manager-cmctl, guac, opa, smarter-device-manager, spegel, vcluster, k8sgpt, tflint,...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: policy-controller, ko, spire-server, witness, gitsign, trivy-operator, vexctl, kyverno-notation-aws, buildkitd, flux-source-controller, kyverno, tflint, kubescape, crossplane, skaffold, zarf, trivy, teleport, docker, goreleaser, tkn, gh, sigstore-scaffolding, falcoct...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: spark-operator, terraform-provider-google, flux-image-reflector-controller, nfs-subdir-external-provisioner, kyverno-notation-aws, opa-envoy, cluster-proportional-autoscaler, opa, smarter-device-manager, dgraph, sriov-network-device-plugin, skaffold,...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: dive, policy-controller, gcsfuse, kubelet-csr-approver, kaf, crane, kube-state-metrics, logstash-exporter, lazydocker, juicefs, terraform-provider-azapi, falco-exporter, docker-machine-driver-harvester, vendir, spire-controller-manager, trivy-operator, yunikorn-web,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: up, policy-controller, rclone, cortex, flux-image-reflector-controller, tekton-chains, spire-server, buildkitd, flux-source-controller, nuclei, opentelemetry-collector, guac, hugo, k8sgpt, kubescape, fluent-bit-plugin-loki, harbor-registry, druid,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: dive, policy-controller, gcsfuse, kubelet-csr-approver, kaf, crane, kube-state-metrics, logstash-exporter, lazydocker, juicefs, terraform-provider-azapi, falco-exporter, docker-machine-driver-harvester, vendir, spire-controller-manager, trivy-operator, yunikorn-web,...

GO-2025-4011 vulnerabilities

Vulnerabilities for packages: dive, policy-controller, gcsfuse, kubelet-csr-approver, kaf, crane, kube-state-metrics, logstash-exporter, lazydocker, juicefs, terraform-provider-azapi, falco-exporter, docker-machine-driver-harvester, vendir, spire-controller-manager, trivy-operator, yunikorn-web,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: dive, cortex, crane, sbom-convert, age, smarter-device-manager, container-object-storage-interface, k6, rancher-webhook, xcover, timoni, atlantis, kube-logging-operator, velero-plugin-for-microsoft-azure, cargobump, sbom-scorecard, kpt, kube-bench, wave, hey, s5cmd,...

GO-2025-4012 vulnerabilities

Vulnerabilities for packages: dive, policy-controller, gcsfuse, kubelet-csr-approver, kaf, crane, kube-state-metrics, logstash-exporter, lazydocker, juicefs, terraform-provider-azapi, falco-exporter, docker-machine-driver-harvester, vendir, spire-controller-manager, trivy-operator, yunikorn-web,...

GO-2025-4010 vulnerabilities

Vulnerabilities for packages: dive, policy-controller, gcsfuse, kubelet-csr-approver, kaf, crane, kube-state-metrics, logstash-exporter, lazydocker, juicefs, terraform-provider-azapi, falco-exporter, docker-machine-driver-harvester, vendir, spire-controller-manager, trivy-operator, yunikorn-web,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: dive, policy-controller, gcsfuse, kubelet-csr-approver, kaf, crane, kube-state-metrics, logstash-exporter, lazydocker, juicefs, terraform-provider-azapi, falco-exporter, docker-machine-driver-harvester, vendir, spire-controller-manager, trivy-operator, yunikorn-web,...

GO-2025-3751 vulnerabilities

Vulnerabilities for packages: dive, authservice, cortex, flannel-cni-plugin, sbom-convert, postgres-operator, age, smarter-device-manager, aws-application-networking-k8s, rancher-webhook, amazon-cloudwatch-agent, filebrowser, steampipe, velero-plugin-for-microsoft-azure, haproxy-ingress,...

GO-2026-4602 vulnerabilities

Vulnerabilities for packages: authservice, cortex, crane, nri-kubernetes, net-kourier, cloudflared, sbom-convert, postgres-operator, smarter-device-manager, container-object-storage-interface, cluster-autoscaler, tigera-operator, aws-application-networking-k8s, rancher-webhook, cilium, trino,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, policy-controller, cortex, kube-state-metrics, nri-kubernetes, lazydocker, spire-server, docker-machine-driver-harvester, net-kourier, temporal, opa-envoy, helm-push, cert-manager-webhook-pdns, descheduler,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: cortex, kaf, kube-state-metrics, spire-server, memcached-exporter, temporal, cloudflared, helm-push, terraform, weaviate, hugo, crossplane-provider-azure-sql, flux-kustomize-controller, flux-helm-controller, nri-mssql, rqlite, skopeo, conftest,...