CLEANSTART-2026-QA16480 Security fix for CVE-2025-61719 applied in: sigstore-scaffolding-fips 0.7.31-r0

Security vulnerability affects the sigstore-scaffolding-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TG34900 Security fix for CVE-2025-66506 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, sigstore-scaffolding 0.7.31-r2

CVE-2025-66506 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-101433

Security vulnerability affects the sigstore-scaffolding-fips package. This issue is resolved in later releases. See references for vulnerability details...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: sops, dex, cilium-cli, spicedb, restic, ferretdb, vcluster, gomplate, opa, grafana-agent-operator, terraform-docs, grpc-health-probe, falcosidekick, fulcio, ksops, kubernetes-csi-external-provisioner, dbmate, guac, minio, pulumi-language-dotnet, cert-manager-cmctl,...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: gh, flux-source-controller, kubescape, skaffold, teleport, docker, goreleaser, trivy-operator, falcoctl, vexctl, witness, buildkitd, policy-controller, tkn, ko, zarf, cosign, neuvector-sigstore-interface, zot, tflint, sigstore-scaffolding, spire-server, tekton-chains...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, skaffold, pulumi-kubernetes-operator, opa, cluster-proportional-autoscaler, pulumi-language-java, opa-envoy, cert-exporter, sriov-network-device-plugin, flyte, step-issuer, pulumi-language-dotnet, spark-operator, amass, terraform-provider-google...

GO-2025-4010 vulnerabilities

Vulnerabilities for packages: bazelisk, kube-bench, sops, azure-workload-identity-webhook, pulumi-kubernetes-operator, ferretdb, ipfs-cluster, prometheus-adapter, dynamic-localpv-provisioner, mongodb-kubernetes-operator, vexctl, falcoctl, terraform-provider-azapi, tofu-controller, kubevela,...

GO-2025-4011 vulnerabilities

Vulnerabilities for packages: bazelisk, kube-bench, sops, azure-workload-identity-webhook, pulumi-kubernetes-operator, ferretdb, ipfs-cluster, prometheus-adapter, dynamic-localpv-provisioner, mongodb-kubernetes-operator, vexctl, falcoctl, terraform-provider-azapi, tofu-controller, kubevela,...

GO-2025-4012 vulnerabilities

Vulnerabilities for packages: bazelisk, kube-bench, sops, azure-workload-identity-webhook, pulumi-kubernetes-operator, ferretdb, ipfs-cluster, prometheus-adapter, dynamic-localpv-provisioner, mongodb-kubernetes-operator, vexctl, falcoctl, terraform-provider-azapi, tofu-controller, kubevela,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: bazelisk, kube-bench, sops, azure-workload-identity-webhook, pulumi-kubernetes-operator, ferretdb, ipfs-cluster, prometheus-adapter, dynamic-localpv-provisioner, mongodb-kubernetes-operator, vexctl, falcoctl, terraform-provider-azapi, tofu-controller, kubevela,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: kiali, azure-workload-identity-webhook, pulumi-kubernetes-operator, ipfs-cluster, dynamic-localpv-provisioner, tofu-controller, neuvector-dbgen, timescaledb-tune, gosu, sealed-secrets, k8sgpt-operator, skopeo, undock, custom-pod-autoscaler, prometheus-pushgateway,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: bazelisk, kube-bench, sops, azure-workload-identity-webhook, pulumi-kubernetes-operator, ferretdb, ipfs-cluster, prometheus-adapter, dynamic-localpv-provisioner, mongodb-kubernetes-operator, vexctl, falcoctl, terraform-provider-azapi, tofu-controller, kubevela,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: harbor-registry, sops, chezmoi, flux-source-controller, kubescape, fluent-bit-plugin-loki, hugo, restic, trino, argo-workflows, up, secrets-store-csi-driver-provider-azure, rclone, goreleaser, cortex, falcoctl, grafana-agent-operator, hugo-extended, velero, buildkitd...

GO-2025-3751 vulnerabilities

Vulnerabilities for packages: azure-workload-identity-webhook, dynamic-localpv-provisioner, karma, k8ssandra-operator, nri-nginx, neuvector-dbgen, gosu, k8sgpt-operator, skopeo, aws-eks-pod-identity-agent, nri-memcached, nats-server, prometheus-pushgateway, nodetaint, thanos-operator,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: sops, gh, terraform-provider-aws, nri-kafka, ferretdb, prometheus-adapter, dynamic-localpv-provisioner, kube-fluentd-operator, vexctl, falcoctl, cadvisor, flux-image-automation-controller, actions-runner-controller, rekor, skopeo, kots, caddy,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kube-bench, sops, kiali, azure-workload-identity-webhook, sftpgo-plugin-pubsub, golangci-lint, rancher-webhook, pulumi-kubernetes-operator, continuity, prometheus-adapter, crossplane-provider-aws-firehose, dynamic-localpv-provisioner, external-secrets-operator,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: kiali, terraform-provider-aws, pulumi-kubernetes-operator, external-secrets-operator, dynamic-localpv-provisioner, vitess, k8ssandra-operator, cluster-autoscaler, tofu-controller, rancher-agent, sftpgo-plugin-eventsearch, cluster-api, flux-image-automation-controller...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: sops, dex, flux-source-controller, kubescape, skaffold, rabbitmq-messaging-topology-operator, argo-workflows, apko, gomplate, goreleaser, vexctl, falcoctl, cloudflared, grpc-health-probe, fulcio, policy-controller, tkn, guac, minio, oauth2-proxy, bank-vaults, ko,...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: kube-bench, sops, gh, spicedb, golangci-lint, terraform-provider-aws, pulumi-kubernetes-operator, ferretdb, prometheus-adapter, rclone, crossplane-provider-aws-firehose, dynamic-localpv-provisioner, kube-fluentd-operator, k8ssandra-operator, falcoctl, envoy-ratelimit...

GO-2025-4193 vulnerabilities

Vulnerabilities for packages: flux-source-controller, kubescape, vexctl, falcoctl, falco-no-driver, witness, tkn, buildah, zarf, cosign, podman, skopeo, kots, sigstore-scaffolding, undock, aactl, tekton-chains, kyverno-notation-aws, slsa-verifier, gitsign, portieris, ratify...