GO-2026-6609 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, prometheus-adapter, falco-no-driver, k6, kyverno-policy-reporter-ui, mesosphere-vsphere-csi, opencost, aactl, juicefs, grafana, rancher-agent, argo-cd, openbao, gitness, karpenter, yunikorn-web, external-dns, k8s-device-plugin,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, prometheus-adapter, falco-no-driver, k6, kyverno-policy-reporter-ui, mesosphere-vsphere-csi, opencost, aactl, juicefs, grafana, rancher-agent, argo-cd, openbao, gitness, karpenter, yunikorn-web, external-dns, k8s-device-plugin,...

CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

CVE-2026-47680 Source controller: Improper path handling allows traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

EUVD-2026-74295

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

GO-2025-3381 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, kyverno-notation-aws, flux-source-controller, flux-source-controller-fips, flux, kyverno...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: kargo, chart-testing-fips, chart-testing, envoy-gateway-fips, helm-operator-fips, rancher-fleet, cerbos, trivy-operator-fips, pluto, zot, chartmuseum-fips, teleport, flux-helm-controller, consul-k8s, envoy-gateway, flux-source-controller, kots, chartmuseum, k8sgpt,...

GO-2024-2554 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, cilium-cli, zarf, flux-source-controller, kots, chartmuseum, helm-push, eksctl, kubevela, k8sgpt, up, kubescape, trivy, zot, helm-operator, k9s...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: gitlab-operator, zarf-fips, cilium-cli, cert-manager-cmctl, zarf, flux-source-controller, kots, helm-diff, flux-source-controller-fips, gitlab-operator-fips, helm-diff-fips, helm-push, kuma, rancher-fleet, rancher-fleet-fips, flux, flux-fips, cert-manager-cmctl-fips...

GO-2024-2575 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, cilium-cli, zarf, flux-source-controller, kots, chartmuseum, helm-push, eksctl, kubevela, k8sgpt, up, kubescape, trivy, zot, helm-operator, k9s...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster, cert-manager-fips, grafana-operator-fips, localstack, victoriametrics-fips, grafana-rollout-operator, steampipe, flux-image-reflector-controller, librechat, omnictl-multiarch, pluto, flux-source-watcher, flux-notification-controller, dkron,...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: kargo, rancher-fleet, headlamp, beats, trivy-operator-fips, zot, containerd, flux-helm-controller, envoy-gateway, amazon-ecs-agent-fips, tekton-pipelines, chartmuseum, kubevela, chainctl, gatekeeper, helm-diff, helm-push, eksctl, apm-server-fips, docker-cli-buildx,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: kargo, rancher-fleet, headlamp, beats, trivy-operator-fips, zot, containerd, flux-helm-controller, envoy-gateway, amazon-ecs-agent-fips, tekton-pipelines, chartmuseum, kubevela, chainctl, gatekeeper, helm-diff, helm-push, eksctl, apm-server-fips, docker-cli-buildx,...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster, cert-manager-fips, grafana-operator-fips, localstack, victoriametrics-fips, grafana-rollout-operator, steampipe, flux-image-reflector-controller, librechat, omnictl-multiarch, pluto, flux-source-watcher, flux-notification-controller, dkron,...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent, syft-fips, kyverno-policy-reporter-ui, ko-fips, kube-bench, hcloud, dive, jitsucom-bulker, wgcf, traefik-fips, pluto, neuvector-sigstore-interface, kyverno-notation-aws-fips, gh, goreleaser, envoy-gateway, kyverno-policy-reporter-ui-fips,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner-fips, kube-state-metrics, prometheus-mysqld-exporter, secrets-store-csi-driver-provider-gcp, dive, vault-csi-provider, oauth2-proxy, terraform-provider-sendgrid, nfs-subdir-external-provisioner, zot, kubeflow-katib,...