Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...

GHSA-JJRM-HR5F-673X Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...

PT-2026-47088

Name of the Vulnerable Software and Affected Versions source-controller versions prior to 1.8.5 Description Improper path handling allows for path traversal in two scenarios. First, an actor capable of influencing the contents of a bucket referenced by a Bucket resource can force the...

FlexRIC 安全漏洞

FlexRIC is an open-source RAN intelligent controller developed by Mosaic5G. The FlexRIC v2.0.0 version contains a security vulnerability. This vulnerability arises from trusting the xappid field in the trust E42 message without binding it to the sender’s SCTP association. As a result, remote...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: argocd-image-updater, zarf, scorecard, dagger, nuclei, zot, pulumi-language-dotnet, kaniko, argo-workflows, skaffold, tfsec, cerbos, pulumi, osv-scanner, kubescape, teleport, trivy-operator, flux-source-controller, witness, act, flux-image-automation-controller,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: grafana-alloy, src-fingerprint, packer-fips, argo-cd, guac, cloudbeat, gptscript, kubescape-server-fips, argo-workflows, gitlab-runner, kaniko, argocd-image-updater-fips, gitlab-rails-ce, rancher-fleet, google-osconfig-agent, kubevela, trufflehog, coder-fips,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: zarf, slsa-verifier, cosign, vexctl, ko, dagger, tkn, zot, skaffold, neuvector-sigstore-interface, kubescape, teleport, trivy-operator, flux-source-controller, policy-controller, tekton-chains, crossplane, docker, rekor, guac, falcoctl, bom, spire-server,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, docker-cli-buildx, cosign, cosign-fips, kyverno-notation-aws-fips, docker, guac, docker-compose, cloudbeat, kubescape-server-fips, tflint, gitlab-runner, tkn, neuvector-sigstore-interface-fips, buildkitd-fips, buildkitd,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: zarf, slsa-verifier, cosign, vexctl, ko, tkn, zot, skaffold, neuvector-sigstore-interface, kubescape, teleport, trivy-operator, flux-source-controller, witness, policy-controller, tekton-chains, crossplane, docker, sigstore-scaffolding, falcoctl, spire-server,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: zarf, slsa-verifier, cosign, vexctl, ko, tkn, zot, skaffold, neuvector-sigstore-interface, kubescape, teleport, trivy-operator, flux-source-controller, witness, policy-controller, tekton-chains, crossplane, docker, sigstore-scaffolding, falcoctl, spire-server,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventsearch, fluxcd-kustomize-mutating-webhook, pluto, smarter-device-manager, aws-network-policy-agent, kubewatch, karpenter, metacontroller, secrets-store-csi-driver-provider-aws, local-path-provisioner, smokescreen, grafana-operator, osv-scanner,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, cloud-provider-aws, k3s, cosign, kube-vip, kyverno-policy-reporter-ui, nerdctl, net-kourier, bank-vaults, contour, scorecard, slsa-verifier, step-ca, nuclei, chartmuseum, openbao, cerbos, helm-mapkubeapis, apisix-ingress-controller, kubescape,...

CVE-2025-47914 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, k3s, cosign, kube-vip, kubernetes-csi-external-provisioner, mongo-tools, nerdctl, bank-vaults, scorecard, aws-otel-collector, flyte, cert-manager-webhook-pdns, nats-server, chartmuseum, crossplane-provider-aws-elasticache, nri-kafka,...

GHSA-J5W8-Q4QC-RX2X vulnerabilities

Vulnerabilities for packages: argocd-image-updater, k3s, cosign, kube-vip, kubernetes-csi-external-provisioner, mongo-tools, frp, bank-vaults, nerdctl, scorecard, aws-otel-collector, step-ca, flyte, cert-manager-webhook-pdns, nats-server, chartmuseum, crossplane-provider-aws-elasticache, nri-kafk...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: argocd-image-updater, k3s, cosign, kube-vip, kubernetes-csi-external-provisioner, mongo-tools, nerdctl, bank-vaults, scorecard, aws-otel-collector, flyte, cert-manager-webhook-pdns, nats-server, chartmuseum, crossplane-provider-aws-elasticache, nri-kafka,...

CVE-2025-58181 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, k3s, cosign, kube-vip, kubernetes-csi-external-provisioner, mongo-tools, frp, bank-vaults, nerdctl, scorecard, aws-otel-collector, step-ca, flyte, cert-manager-webhook-pdns, nats-server, chartmuseum, crossplane-provider-aws-elasticache, nri-kafk...

CVE-2025-9148 CodePhiliaX Chat2DB JDBC Connection DataSourceController.java sql injection

A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects an unknown function of the file ai/chat2db/server/web/api/controller/data/source/DataSourceController.java of the component JDBC Connection Handler. The manipulation results in sql injection. The attack can be executed...

PT-2025-33817 · Unknown · Codephiliax Chat2Db

Name of the Vulnerable Software and Affected Versions: CodePhiliaX Chat2DB versions through 0.3.7 Description: A SQL injection issue exists in the JDBC Connection Handler component of CodePhiliaX Chat2DB. The issue affects an unknown function within the...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-fips, skopeo-fips, gatus, newrelic-fluent-bit-output, nvidia-nsight-compute-13.2, kubernetes-csi-external-provisioner, kubecolor, neuvector-scanner-fips, azure-ipam, amazon-k8s-cni, guac, azuredisk-csi-fips, cfssl, apache-beam-python-3.11-sdk,...

CVE-2024-31216

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to versi...