GO-2026-6609 vulnerabilities

Vulnerabilities for packages: filebrowser, step, kyverno-policy-reporter, gitlab-pages, temporal-ui-server, zarf, juicefs, flux-source-controller, continuity, rclone, headlamp, grafana-pyroscope, ingress-nginx-controller, k8s-device-plugin, prometheus-adapter, falco-no-driver, grafana-alloy, loki...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: filebrowser, step, kyverno-policy-reporter, gitlab-pages, temporal-ui-server, zarf, juicefs, flux-source-controller, continuity, rclone, headlamp, grafana-pyroscope, ingress-nginx-controller, k8s-device-plugin, prometheus-adapter, falco-no-driver, grafana-alloy, loki...

CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

EUVD-2026-74295

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a "Bucket"...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

GO-2025-3381 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, flux-source-controller-fips, flux-source-controller, kyverno-notation-aws-fips, flux...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: k9s, up, zarf, eksctl, helm-push, flux-source-controller, helm-operator, kubevela, chartmuseum, trivy, kots, zot, k8sgpt, flux-helm-controller, cilium-cli, kubescape...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: k9s, up, zarf, eksctl, helm-push, flux-source-controller, helm-operator, kubevela, chartmuseum, trivy, kots, zot, k8sgpt, flux-helm-controller, cilium-cli, kubescape...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: zarf-fips, cert-manager-cmctl, gitlab-operator-fips, gitlab-operator, flux-source-controller-fips, zarf, helm-push, flux-source-controller, flux-fips, helm-diff-fips, rancher-fleet-fips, kots, kuma, rancher-fleet, cert-manager-cmctl-fips, flux, cilium-cli, helm-diff...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: k8ssandra-client-fips, consul-k8s-fips, envoy-gateway, pluto, helm-operator, chart-testing, cerbos, tw, harbor, helm-operator-fips, trivy-fips, teleport, flux-source-controller, chart-testing-fips, chartmuseum, kuma, rancher-fleet, cilium-cli, helm-docs,...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, pluto, grafana-operator, metacontroller, victoriametrics, podinfo, cert-manager-fips, flux-operator, pgwatch, cluster-autoscaler-fips, victoriametrics-fips, gotenberg, flux-source-controller, polaris, dkron, go, grafana-fips, librechat,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, pluto, grafana-operator, metacontroller, victoriametrics, podinfo, cert-manager-fips, flux-operator, pgwatch, cluster-autoscaler-fips, victoriametrics-fips, gotenberg, flux-source-controller, polaris, dkron, go, grafana-fips, librechat,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: buildkitd, tw, opa, rancher-agent, flux-source-controller, google-osconfig-agent, helm-diff-fips, chartmuseum, opa-fips, rancher-fleet, kaniko-fips, kubevela, gogatekeeper, falco-no-driver, chartmuseum-fips, dagger, skaffold-fips, melange, opa-envoy, syft, xeol,...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: buildkitd, tw, opa, rancher-agent, flux-source-controller, google-osconfig-agent, helm-diff-fips, chartmuseum, opa-fips, rancher-fleet, kaniko-fips, kubevela, gogatekeeper, falco-no-driver, chartmuseum-fips, dagger, skaffold-fips, melange, opa-envoy, syft, xeol,...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: cosign, splunk-otel-collector, dataplaneapi, spire-server-fips, kube-bench-fips, prometheus, opa, grype-db, golangci-lint, podinfo, agentbeat, terraform-provider-acme, mattermost, flux-source-controller, chart-testing-fips, goreleaser, atlantis-fips,...