GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws, dataplaneapi, victoriametrics, stakater-reloader, victoriametrics-cluster, go, goreleaser, mountpoint-s3-csi-driver, karpenter, dkron, flux-image-reflector-controller, flux, grafana-rollout-operator, omnibump, apko, oras, nova,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: bank-vaults, argo-events, openbao, rclone, vexctl, cloud-provider-aws, zot, azure-service-operator, kubescape, newrelic-infrastructure-agent, falco-exporter, grafana-agent-operator, rancher-machine, bento, terraform-provider-tls, redpanda, splunk-otel-collector,...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: nats-server, cloud-provider-aws, crossplane-provider-aws-cloudwatchlogs, grafana-agent-operator, pulumi-kubernetes-operator, chezmoi, prometheus-alertmanager, terraform-provider-azuread, kubevela, cluster-api-aws-controller, amazon-cloudwatch-agent, falco-no-driver,...

GHSA-J5W8-Q4QC-RX2X vulnerabilities

Vulnerabilities for packages: nats-server, cloud-provider-aws, crossplane-provider-aws-cloudwatchlogs, grafana-agent-operator, pulumi-kubernetes-operator, chezmoi, terraform-provider-azurerm, prometheus-alertmanager, terraform-provider-azuread, kubevela, cluster-api-aws-controller,...

CVE-2025-47914 vulnerabilities

Vulnerabilities for packages: nats-server, cloud-provider-aws, crossplane-provider-aws-cloudwatchlogs, grafana-agent-operator, pulumi-kubernetes-operator, chezmoi, prometheus-alertmanager, terraform-provider-azuread, kubevela, cluster-api-aws-controller, amazon-cloudwatch-agent, falco-no-driver,...

CVE-2025-58181 vulnerabilities

Vulnerabilities for packages: nats-server, cloud-provider-aws, crossplane-provider-aws-cloudwatchlogs, grafana-agent-operator, pulumi-kubernetes-operator, chezmoi, terraform-provider-azurerm, prometheus-alertmanager, terraform-provider-azuread, kubevela, cluster-api-aws-controller,...

CVE-2025-9148 CodePhiliaX Chat2DB JDBC Connection DataSourceController.java sql injection

A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects an unknown function of the file ai/chat2db/server/web/api/controller/data/source/DataSourceController.java of the component JDBC Connection Handler. The manipulation results in sql injection. The attack can be executed...

PT-2025-33817 · Unknown · Codephiliax Chat2Db

Name of the Vulnerable Software and Affected Versions: CodePhiliaX Chat2DB versions through 0.3.7 Description: A SQL injection issue exists in the JDBC Connection Handler component of CodePhiliaX Chat2DB. The issue affects an unknown function within the...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: podman, authservice, fulcio, cert-manager-csi-driver, kube-logging-logging-operator, neuvector, trivy-fips, amazon-ssm-agent, cilium-envoy-fips, influxd, skaffold-fips, terraform, crossplane-provider-sql, sqlexporter-fips, kuma,...

CVE-2024-31216

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to versi...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: consul-k8s, helm-push, zot, kubescape, helm-docs, eksctl, cluster-api-helm-controller, kots, tw, zarf, flux, chartmuseum, k9s, trivy, flux-source-controller, k8ssandra-client, pluto, cilium-cli, chart-testing, helm-operator, rancher-helm, flux-helm-controller,...

GHSA-4HFP-H4CW-HJ8P vulnerabilities

Vulnerabilities for packages: consul-k8s, helm-push, zot, kubescape, helm-docs, eksctl, cluster-api-helm-controller, kots, tw, zarf, flux, chartmuseum, k9s, trivy, flux-source-controller, k8ssandra-client, pluto, cilium-cli, chart-testing, helm-operator, rancher-helm, flux-helm-controller,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: consul-k8s, helm-push, zot, kubescape, helm-docs, eksctl, cluster-api-helm-controller, kots, tw, zarf, flux, chartmuseum, k9s, trivy, flux-source-controller, k8ssandra-client, pluto, cilium-cli, chart-testing, helm-operator, rancher-helm, flux-helm-controller,...

GHSA-5XQW-8HWV-WG92 vulnerabilities

Vulnerabilities for packages: consul-k8s, helm-push, zot, kubescape, helm-docs, eksctl, cluster-api-helm-controller, kots, tw, zarf, flux, chartmuseum, k9s, trivy, flux-source-controller, k8ssandra-client, pluto, cilium-cli, chart-testing, helm-operator, rancher-helm, flux-helm-controller,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: syft, helm-push, zot, kubescape, newrelic-infrastructure-agent, kaniko, eksctl, cluster-api-helm-controller, linkerd2, buildkitd, kots, zarf, chartmuseum, kubevela, trivy, nerdctl, flux-source-controller, ctop, k8ssandra-client, opa-envoy, osv-scanner, melange,...

CVE-2024-40635 vulnerabilities

Vulnerabilities for packages: syft-fips, beats-fips, cluster-api-helm-controller, envoy-gateway, rancher-fleet-fips, syft, kubescape, consul-k8s, docker-fips, wolfictl, nerdctl, beats, kaniko-fips, neuvector, neuvector-scanner-fips, trivy-fips, xeol, neuvector-fips, flux-helm-controller-fips,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: syft-fips, beats-fips, cluster-api-helm-controller, envoy-gateway, rancher-fleet-fips, syft, kubescape, consul-k8s, docker-fips, wolfictl, nerdctl, beats, kaniko-fips, neuvector, neuvector-scanner-fips, trivy-fips, xeol, neuvector-fips, flux-helm-controller-fips,...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: pulumi, bank-vaults, argo-events, sigstore-scaffolding, rclone, sqlpad, tkn, zot, sops, kubescape, wal-g, druid, grafana-agent-operator, chezmoi, guac, py3-azure-identity, rekor, step-ca, timestamp-authority, velero, buildkitd, goreleaser, airflow, prometheus-operato...

GO-2024-2859 source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller

source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller...

CVE-2024-31216 source-controller leaks theAzure Storage SAS token into logs on connection errors

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to versi...