CVE-2026-49478 vulnerabilities

Vulnerabilities for packages: buildah, aactl, gitsign, kyverno, kubescape, podman, skopeo, tekton-chains, undock, falcoctl, ratify, slsa-verifier, flux-source-controller, kots, kyverno-notation-aws, witness, zarf...

GHSA-F5MR-Q85P-6HH6 vulnerabilities

Vulnerabilities for packages: buildah, aactl, gitsign, kyverno, kubescape, podman, skopeo, tekton-chains, undock, falcoctl, ratify, slsa-verifier, flux-source-controller, kots, kyverno-notation-aws, witness, zarf...

CVE-2026-49478 vulnerabilities

Vulnerabilities for packages: portieris-fips, podman, tekton-chains, kubescape, kyverno, falcoctl, slsa-verifier, buildah, prometheus-podman-exporter, kyverno-notation-aws-fips, tekton-chains-fips, zarf, flux-source-controller-fips, chainctl-fips, undock, falcoctl-fips, podman-fips, zarf-fips,...

GHSA-F5MR-Q85P-6HH6 vulnerabilities

Vulnerabilities for packages: portieris-fips, podman, tekton-chains, kubescape, kyverno, falcoctl, slsa-verifier, buildah, prometheus-podman-exporter, kyverno-notation-aws-fips, tekton-chains-fips, zarf, flux-source-controller-fips, chainctl-fips, undock, falcoctl-fips, podman-fips, zarf-fips,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: nerdctl, minio-fips, mattermost-fips, trivy-fips, osv-scanner, argo-cd, reports-server, skaffold-fips, terraform, cloudbeat-fips, trivy-operator-fips, kuma, flux-image-automation-controller-fips, rancher, vitess, kube-state-metrics, etcd, upwind-agent, gitea-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, syft-fips, podman, flux-notification-controller-fips, pulumi-kubernetes-operator, docker-fips, ollama-fips, fulcio, minio-fips, nerdctl, mattermost-fips, pulumi, trivy-fips, clickhouse-backup-fips, amazon-ssm-agent,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: nerdctl, minio-fips, mattermost-fips, trivy-fips, osv-scanner, argo-cd, reports-server, skaffold-fips, terraform, cloudbeat-fips, trivy-operator-fips, kuma, flux-image-automation-controller-fips, rancher, vitess, kube-state-metrics, etcd, upwind-agent, gitea-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: syft-fips, podman, pulumi-kubernetes-operator, nerdctl, minio-fips, mattermost-fips, pulumi, trivy-fips, amazon-ssm-agent, osv-scanner, argo-cd, mapotf, reports-server, melange, skaffold-fips, terraform, cloudbeat-fips, jfrog-cli, trivy-operator-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: syft-fips, podman, pulumi-kubernetes-operator, docker-fips, nerdctl, minio-fips, mattermost-fips, pulumi, trivy-fips, clickhouse-backup-fips, amazon-ssm-agent, osv-scanner, argo-cd, mapotf, reports-server, melange, skaffold-fips, terraform, cloudbeat-fips, jfrog-cli,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: argo-events, openbao, cloud-provider-aws, age, kubescape, sops, zot, pulumi-kubernetes-operator, chezmoi, rancher-machine, terraform-provider-azurerm, terraform-provider-tls, splunk-otel-collector, flux, nerdctl, go-discover, kargo, pulumi-language-java,...

GHSA-JJRM-HR5F-673X Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...

Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...

PT-2026-47088

Name of the Vulnerable Software and Affected Versions source-controller versions prior to 1.8.5 Description Improper path handling allows for path traversal in two scenarios. First, an actor capable of influencing the contents of a bucket referenced by a Bucket resource can force the...

FlexRIC 安全漏洞

FlexRIC is an open-source RAN intelligent controller developed by Mosaic5G. The FlexRIC v2.0.0 version contains a security vulnerability. This vulnerability arises from trusting the xappid field in the trust E42 message without binding it to the sender’s SCTP association. As a result, remote...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: pulumi, pulumi-language-dotnet, argo-events, syft, grafana-alloy, teleport, gptscript, kubescape, zot, kaniko, pulumi-kubernetes-operator, guac, tfsec, pulumi-language-yaml, goreleaser, kots, witness, zarf, flux, argo-workflows, kubevela, k9s, apko, kyverno, trivy,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: syft-fips, pulumi-kubernetes-operator, pulumi, trivy-fips, amazon-ssm-agent, osv-scanner, argo-cd, goreleaser, mapotf, xeol-fips, melange, skaffold-fips, cloudbeat-fips, jfrog-cli, trivy-operator-fips, gitlab-runner, cerbos, chainctl-fips, upwind-agent, gitea-fips,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: tkn, vexctl, teleport, zot, kubescape, guac, rekor, buildkitd, goreleaser, zarf, kyverno, trivy, bom, slsa-verifier, ratify, flux-source-controller, gh, neuvector-sigstore-interface, gitlab-runner, cosign, crossplane, aactl, gitsign, falcoctl, spire-server,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: docker-fips, vexctl, trivy-fips, goreleaser, reports-server, falcoctl, skaffold-fips, cloudbeat-fips, jfrog-cli, trivy-operator-fips, gitlab-runner, tekton-chains-fips, chainctl-fips, falcoctl-fips, buildkitd, rekor, ratify, zot, kyverno-fips, policy-controller,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, tkn, vexctl, teleport, zot, kubescape, buildkitd, goreleaser, witness, zarf, kyverno, trivy, slsa-verifier, ratify, flux-source-controller, gh, neuvector-sigstore-interface, cosign, crossplane, aactl, gitsign, falcoctl, spire-server,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, tkn, vexctl, teleport, zot, kubescape, buildkitd, goreleaser, witness, zarf, kyverno, trivy, slsa-verifier, ratify, flux-source-controller, gh, neuvector-sigstore-interface, cosign, crossplane, aactl, gitsign, falcoctl, spire-server,...