CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

GO-2025-3381 vulnerabilities

Vulnerabilities for packages: kyverno-fips, kyverno-notation-aws, flux-source-controller, kyverno-notation-aws-fips, kyverno, flux-source-controller-fips, flux-fips, flux...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: zot, cilium-cli, kots, up, flux-source-controller, eksctl, flux-helm-controller, trivy, k8sgpt, helm-operator, kubescape, helm-push, kubevela, k9s, zarf, chartmuseum...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: cilium-cli, eksctl, flux-helm-controller, helm-docs, harbor-fips, linkerd2, chartmuseum, chart-testing-fips, harbor, zot, teleport, rancher-helm, flux-source-controller, trivy, envoy-gateway-fips, helm-operator, istio, trivy-operator-fips, zarf, k9s,...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: zot, cilium-cli, kots, up, flux-source-controller, eksctl, flux-helm-controller, trivy, k8sgpt, helm-operator, kubescape, helm-push, kubevela, k9s, zarf, chartmuseum...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: gitlab-operator, helm-diff-fips, rancher-fleet, cilium-cli, kots, flux-source-controller, helm-diff, zarf, helm-push, zarf-fips, rancher-fleet-fips, flux-source-controller-fips, kuma, flux-fips, flux, cert-manager-cmctl, gitlab-operator-fips, cert-manager-cmctl-fips...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: localstack, terragrunt, grafana-rollout-operator, flux-helm-controller, steampipe, victorialogs, grafana-operator-fips, polaris, dkron, nova-fips, victoriametrics-cluster-fips, flux-source-controller, amazon-k8s-cni-fips, metacontroller, grafana-fips, librechat,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: localstack, terragrunt, grafana-rollout-operator, flux-helm-controller, steampipe, victorialogs, grafana-operator-fips, polaris, dkron, nova-fips, victoriametrics-cluster-fips, flux-source-controller, amazon-k8s-cni-fips, metacontroller, grafana-fips, librechat,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: skaffold-fips, buildkitd, newrelic-infrastructure-agent, beats, steampipe, amazon-ecs-agent-fips, cloudbeat-fips, gitlab-rails-ce-fips, xeol-fips, kubevela, spegel, cert-manager-cmctl, helm-mapkubeapis, k8ssandra-client, kubescape-operator, consul-k8s,...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: skaffold-fips, buildkitd, newrelic-infrastructure-agent, beats, steampipe, amazon-ecs-agent-fips, cloudbeat-fips, gitlab-rails-ce-fips, xeol-fips, kubevela, spegel, cert-manager-cmctl, helm-mapkubeapis, k8ssandra-client, kubescape-operator, consul-k8s,...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: witness, mattermost, kube-bench-fips, syft-fips, kyverno, istio-fips, traefik, steampipe, wgcf, chart-testing-fips, amazon-cloudwatch-agent-operator-fips, kube-state-metrics-fips, goreleaser, prometheus-fips, swagger, gcsfuse, grafana-alloy-fips, tflint,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, buildkitd, newrelic-infrastructure-agent, prometheus-node-exporter, kubeflow-fips, prometheus-statsd-exporter, secrets-store-csi-driver, dex, wavefront-collector-for-kubernetes, prometheus-alertmanager, kube-fluentd-operator, memcached-exporter,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: tkn, apko, melange, cosign, ko, flux-source-controller, slsa-verifier, aactl, kubescape, falcoctl-fips, policy-controller, spire-server, spire-server-fips, skaffold, tekton-chains...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, dex, skopeo, gitsign, sigstore-scaffolding-fips, falcoctl-fips, tekton-chains, vault-csi-provider, gomplate, timestamp-authority-fips, kubernetes-dashboard-fips, terragrunt, temporal-ui-server, spire-server-fips, sops, zot, flux-kustomize-controller,...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: witness, ratify-fips, kyverno, skopeo, gitsign, skopeo-fips, kubescape-server-fips, portieris-fips, flux-source-controller, aactl, zarf, falcoctl, slsa-verifier, kubescape, kyverno-notation-aws-fips, falcoctl-fips, flux-source-controller-fips, tekton-chains-fips,...

GO-2026-5014 vulnerabilities

Vulnerabilities for packages: etcd, skaffold-fips, mattermost, kyverno, traefik, cloudbeat-fips, gitlab-rails-ce-fips, zitadel, harbor, coder-fips, kuma, omnictl-multiarch, frankenphp-8.5, knative-kafka-broker, prometheus-fips, upwind-agent, drone, frankenphp-8.2, flux-source-controller-fips,...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: tkn, witness, cloudbeat, ratify-fips, kyverno-policy-reporter-plugins-kyverno, kyverno, policy-controller-fips, cloudbeat-fips, gitsign, zot, teleport, flux-source-controller, aactl, falcoctl, tkn-fips, kyverno-notation-aws-fips, falcoctl-fips, tekton-chains-fips,...

GO-2026-4355 vulnerabilities

Vulnerabilities for packages: gh, tkn, skaffold-fips, witness, buildkitd, cloudbeat, ratify-fips, kyverno-policy-reporter-plugins-kyverno, vexctl, kyverno, policy-controller-fips, spire-server, spire-server-fips, cloudbeat-fips, gitsign, zot, teleport, flux-source-controller, trivy,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: gh, tkn, vexctl, policy-controller-fips, spire-server, spire-server-fips, neuvector-sigstore-interface-fips, gitsign, zot, sigstore-scaffolding, apko, melange, flux-source-controller, trivy, aactl, zarf, sigstore-scaffolding-fips, falcoctl, tkn-fips, slsa-verifier,...