CVE-2026-49478 vulnerabilities

Vulnerabilities for packages: gitsign, tekton-chains, flux-source-controller, witness, kots, buildah, undock, ratify, zarf, podman, kubescape, slsa-verifier, kyverno-notation-aws, kyverno, aactl, skopeo, falcoctl...

GHSA-F5MR-Q85P-6HH6 vulnerabilities

Vulnerabilities for packages: gitsign, tekton-chains, flux-source-controller, witness, kots, buildah, undock, ratify, zarf, podman, kubescape, slsa-verifier, kyverno-notation-aws, kyverno, aactl, skopeo, falcoctl...

GHSA-F5MR-Q85P-6HH6 vulnerabilities

Vulnerabilities for packages: chainctl-fips, slsa-verifier, flux-source-controller, kyverno-notation-aws, portieris-fips, kubescape-server-fips, ratify, buildah-fips, kots, kubescape, kubescape-server, ratify-fips, prometheus-podman-exporter-fips, kyverno-notation-aws-fips, skopeo-fips, gitsign,...

CVE-2026-49478 vulnerabilities

Vulnerabilities for packages: chainctl-fips, slsa-verifier, flux-source-controller, kyverno-notation-aws, portieris-fips, kubescape-server-fips, ratify, buildah-fips, kots, kubescape, kubescape-server, ratify-fips, prometheus-podman-exporter-fips, kyverno-notation-aws-fips, skopeo-fips, gitsign,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: cloudbeat, kube-state-metrics, nerdctl, etcd-fips, trivy-operator, rancher, spire-server, cloud-provider-aws, opentelemetry-collector, flux-image-automation-controller, gitlab-rails-ce-fips, calico-fips, gitlab-workhorse-ce-fips, skaffold-fips, loki,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: cloudbeat, kyverno-policy-reporter-plugins-kyverno-fips, apko, step, kube-state-metrics, kyverno-policy-reporter-plugins-kyverno, steampipe, terraform-provider-azurerm, gatus, nerdctl, buildkitd-fips, etcd-fips, trivy-operator, rancher, spire-server,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: cloudbeat, apko, kube-state-metrics, gatus, nerdctl, etcd-fips, trivy-operator, rancher, spire-server, longhorn-cli, cloud-provider-aws, opentelemetry-collector, flux-image-automation-controller, gitlab-rails-ce-fips, peerdb-flow, podman-fips, longhorn-manager-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: cloudbeat, apko, kube-state-metrics, nerdctl, etcd-fips, trivy-operator, spire-server, cloud-provider-aws, opentelemetry-collector, flux-image-automation-controller, gitlab-rails-ce-fips, podman-fips, mapotf, argo-events, calico-fips, gitlab-workhorse-ce-fips, syft,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: cloudbeat, kube-state-metrics, nerdctl, etcd-fips, trivy-operator, rancher, spire-server, cloud-provider-aws, opentelemetry-collector, flux-image-automation-controller, gitlab-rails-ce-fips, calico-fips, gitlab-workhorse-ce-fips, skaffold-fips, loki,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: snyk-cli, gomplate, wal-g, apko, cluster-api-azure-controller, skaffold, pulumi-language-dotnet, falcoctl, kots, kine, ksops, act, mattermost, docker-machine-driver-harvester, rancher, syft, fscrypt, external-dns, crossplane-provider-family-azure,...

Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...

GHSA-JJRM-HR5F-673X Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...

PT-2026-47088

Name of the Vulnerable Software and Affected Versions source-controller versions prior to 1.8.5 Description Improper path handling allows for path traversal in two scenarios. First, an actor capable of influencing the contents of a bucket referenced by a Bucket resource can force the...

FlexRIC 安全漏洞

FlexRIC is an open-source RAN intelligent controller developed by Mosaic5G. The FlexRIC v2.0.0 version contains a security vulnerability. This vulnerability arises from trusting the xappid field in the trust E42 message without binding it to the sender’s SCTP association. As a result, remote...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: snyk-cli, witness, gomplate, nfpm, zarf, trufflehog, kubescape, pulumi-language-java, wolfictl, apko, skaffold, grype, argo-cd, gitaly, argocd-image-updater, kubevela, pulumi-language-dotnet, rancher-fleet, kots, gitlab-runner, argo-workflows, gitea, nuclei, xeol, ac...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: cloudbeat, apko, steampipe, trivy-operator, flux-image-automation-controller, kaniko, gitlab-rails-ce-fips, mapotf, kaniko-fips, argo-events, syft, skaffold-fips, grype-db, zarf-fips, zot, gitlab-runner, trivy, crossplane-fips, jfrog-cli, grafana-alloy, kyverno-fips,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: tekton-chains, zarf, rekor, kubescape, skaffold, policy-controller, aactl, falcoctl, docker-compose, gitlab-runner, docker, tflint, gh, buildkitd, tkn, crossplane, flux-source-controller, neuvector-sigstore-interface, ratify, guac, trivy, teleport, slsa-verifier,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: cloudbeat, image-factory, kyverno-policy-reporter-plugins-kyverno-fips, kyverno-policy-reporter-plugins-kyverno, rekor-fips, buildkitd-fips, spire-server-fips, trivy-operator, spire-server, ratify-fips, tflint, docker, skaffold-fips, neuvector-sigstore-interface,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: tekton-chains, witness, zarf, kubescape, skaffold, policy-controller, aactl, falcoctl, docker, tflint, gh, buildkitd, tkn, crossplane, flux-source-controller, neuvector-sigstore-interface, ratify, trivy, teleport, slsa-verifier, goreleaser, sigstore-scaffolding,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: tekton-chains, witness, zarf, kubescape, skaffold, policy-controller, aactl, falcoctl, docker, tflint, gh, buildkitd, tkn, crossplane, flux-source-controller, neuvector-sigstore-interface, ratify, trivy, teleport, slsa-verifier, goreleaser, sigstore-scaffolding,...