GO-2025-3485 vulnerabilities

Vulnerabilities for packages: hydra, bank-vaults, spiffe-helper, octo-sts, grpc-health-probe, tkn, kubescape, dgraph, ko, oauth2-proxy, dagdotdev, nerdctl, step, guac, skaffold, apko, kargo, grafana-alloy, zot, podman, opentofu, vault-benchmark, spire-server, k3s, steampipe, flux-source-controlle...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: zot, bank-vaults, rekor, sops, argo-events, rabbitmq-messaging-topology-operator, crossplane-provider-azure-sql, scorecard, spire-server, k3s, pulumi-kubernetes-operator, tekton-chains, zarf, crossplane-provider-family-azure, gitsign, grafana-mimir, skopeo, falcoctl,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: atlantis, newrelic-nri-statsd, kube-bench, crossplane-provider-aws, kubewatch, bank-vaults, chartmuseum, nfs-subdir-external-provisioner, rootlesskit, nri-prometheus, pulumi-kubernetes-operator, wireguard-go, kind, kubernetes-csi-driver-hostpath, metrics-server, gops...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: atlantis, age, nfpm, rootlesskit, pulumi-kubernetes-operator, external-secrets-operator, tkn, kubescape, crossplane-provider-azure-authorization, docker, gh, rancher-machine, syft, glab, ko, step, kine, datadog-agent, nerdctl, mattermost, buildkitd, docker-cli-buildx...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, harbor, hydra, bank-vaults, cluster-autoscaler, addon-resizer, chartmuseum, kserve-modelmesh-serving, octo-sts, pulumi-kubernetes-operator, vault-env, cluster-api-provider-vsphere, kubernetes-csi-driver-hostpath, k6,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, goreleaser, prometheus-alertmanager, policy-controller, kube-mgmt-fips, influxd, sftpgo, grype, vault-fips, juicefs, policy-controller-fips, crossplane-provider-aws-organizations-fips, grafana-rollout-operator, kube-arangodb, consul-k8...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, goreleaser, prometheus-alertmanager, policy-controller, kube-mgmt-fips, influxd, sftpgo, grype, vault-fips, juicefs, policy-controller-fips, crossplane-provider-aws-organizations-fips, grafana-rollout-operator, kube-arangodb, consul-k8...

CVE-2026-24051 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, kyverno-policy-reporter-plugins-kyverno, policy-controller, sftpgo, grype, vault-fips, juicefs, policy-controller-fips, kube-arangodb, istio-fips, grype-fips, azuredisk-csi-fips, helm-operator-fips, livekit-server, cert-manager-webhook-pdns,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, kyverno-policy-reporter-plugins-kyverno, policy-controller, sftpgo, grype, vault-fips, juicefs, policy-controller-fips, kube-arangodb, istio-fips, grype-fips, azuredisk-csi-fips, helm-operator-fips, livekit-server, cert-manager-webhook-pdns,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: loki-fips, k3s, flux-kustomize-controller, flux-kustomize-controller-fips, fulcio, sftpgo, vault-fips, juicefs, nri-mysql, terragrunt, ory-kratos, age, cerbos, temporal, grafana-alloy, step-fips, step-kms-plugin, kyverno, sqlexporter, trufflehog,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: hydra, bank-vaults, spiffe-helper, octo-sts, grpc-health-probe, tkn, kubescape, dgraph, ko, oauth2-proxy, dagdotdev, nerdctl, step, guac, skaffold, apko, kargo, grafana-alloy, zot, podman, opentofu, vault-benchmark, spire-server, k3s, steampipe, flux-source-controlle...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: k3s, octo-sts, flux-kustomize-controller, goreleaser, neuvector-scanner, flux-kustomize-controller-fips, harbor, fulcio, policy-controller, ko, sftpgo, vexctl, grpc-health-probe, policy-controller-fips, kyverno-notation-aws, consul-k8s-fips, consul-k8s, istio-fips,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: hydra, bank-vaults, spiffe-helper, octo-sts, grpc-health-probe, tkn, kubescape, dgraph, ko, oauth2-proxy, dagdotdev, nerdctl, step, guac, skaffold, apko, kargo, grafana-alloy, zot, podman, opentofu, vault-benchmark, spire-server, k3s, steampipe, flux-source-controlle...

OPENSUSE-SU-2025:14612-1 sops-3.9.3-1.1 on GA media

These are all security issues fixed in the sops-3.9.3-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-32GQ-X56H-299C vulnerabilities

Vulnerabilities for packages: grafana-fips, age-fips, age, ksops, flux-kustomize-controller, flux-kustomize-controller-fips, sops, sops-fips, litestream, chezmoi, grafana...

GO-2022-0410 Local directory executable lookup in sops (Windows-only) in go.mozilla.org/sops

Local directory executable lookup in sops Windows-only in go.mozilla.org/sops...

OPENSUSE-SU-2024:14104-1 sops-3.9.0-1.1 on GA media

These are all security issues fixed in the sops-3.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: k3s, flux-kustomize-controller, goreleaser, kubernetes-dashboard, fulcio, policy-controller, ko, vexctl, grpc-health-probe, policy-controller-fips, terragrunt, guac, zarf, kube-rbac-proxy, temporal, weaviate, bank-vaults-fips, kube-oidc-proxy, minio-fips,...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, flux-kustomize-controller, crossplane-provider-aws-cloudwatchlogs, flux-notification-controller, crossplane-provider-aws-lambda, goreleaser, kubevela, crossplane-provider-aws-elasticache, crossplane-provider-aws-rds, argo-workflows...

Malicious code in helm-secrets-sops-driver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90757472cd29931d6c7fbc69f6821bd0be3b056fdf34c1d231e3c4ad896f2f54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...