GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: karpenter, fluxcd-kustomize-mutating-webhook, github-mcp-server, mountpoint-s3-csi-driver, smokescreen, envoy-ratelimit, metacontroller, malcontent, newrelic-k8s-metadata-injection, newrelic-infra-operator, aws-privateca-issuer, secrets-store-csi-driver-provider-aws,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: authservice, karpenter, step, crossplane-provider-sql, opa-envoy, aws-node-termination-handler, nerdctl, terraform-provider-pagerduty, harbor, swagger, jitsucom-bulker, apache-exporter, kots, cert-manager, terraform-provider-azuread, vault-secrets-webhook, ko,...

CVE-2025-47914 vulnerabilities

Vulnerabilities for packages: nri-mssql, traefik, glab, nerdctl, thanos, loki, kots, hugo, rancher-fleet, ferretdb, cert-exporter, azuredisk-csi, rancher-webhook, migrate, kargo, fulcio, kserve-modelmesh-serving, blob-csi, crossplane-provider-aws-memorydb, istio, descheduler, k3d, cloudflared,...

CVE-2025-58181 vulnerabilities

Vulnerabilities for packages: nri-mssql, traefik, glab, nerdctl, loki, kots, hugo, rancher-fleet, ferretdb, cert-exporter, azuredisk-csi, osv-scanner, migrate, kargo, fulcio, kserve-modelmesh-serving, blob-csi, crossplane-provider-aws-memorydb, istio, descheduler, k3d, cloudflared, cloudprober,...

GHSA-J5W8-Q4QC-RX2X vulnerabilities

Vulnerabilities for packages: nri-mssql, traefik, glab, nerdctl, loki, kots, hugo, rancher-fleet, ferretdb, cert-exporter, azuredisk-csi, osv-scanner, migrate, kargo, fulcio, kserve-modelmesh-serving, blob-csi, crossplane-provider-aws-memorydb, istio, descheduler, k3d, cloudflared, cloudprober,...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: nri-mssql, traefik, glab, nerdctl, thanos, loki, kots, hugo, rancher-fleet, ferretdb, cert-exporter, azuredisk-csi, rancher-webhook, migrate, kargo, fulcio, kserve-modelmesh-serving, blob-csi, crossplane-provider-aws-memorydb, istio, descheduler, k3d, cloudflared,...

CVE-2025-9148 CodePhiliaX Chat2DB JDBC Connection DataSourceController.java sql injection

A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects an unknown function of the file ai/chat2db/server/web/api/controller/data/source/DataSourceController.java of the component JDBC Connection Handler. The manipulation results in sql injection. The attack can be executed...

PT-2025-33817 · Unknown · Codephiliax Chat2Db

Name of the Vulnerable Software and Affected Versions: CodePhiliaX Chat2DB versions through 0.3.7 Description: A SQL injection issue exists in the JDBC Connection Handler component of CodePhiliaX Chat2DB. The issue affects an unknown function within the...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: cluster-api-aws-controller, cert-manager-csi-driver, kubecolor, nvidia-nsight-compute-13.2, supercronic, volume-modifier-for-k8s, kubernetes-dns-node-cache, dive, cluster-autoscaler-fips, lazygit, hcloud, descheduler-fips, gitness, cert-manager-fips, grafana, mods,...

CVE-2024-31216

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to versi...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, eksctl, chart-testing, helm-operator, zarf, kots, k9s, cilium-cli, helm-docs, flux-helm-controller, trivy, tw, helm-push, consul-k8s, flux, rancher-helm, zot, chartmuseum, kubescape, pluto, flux-source-controller, cluster-api-helm-controller,...

GHSA-4HFP-H4CW-HJ8P vulnerabilities

Vulnerabilities for packages: k8ssandra-client, eksctl, chart-testing, helm-operator, zarf, kots, k9s, cilium-cli, helm-docs, flux-helm-controller, trivy, tw, helm-push, consul-k8s, flux, rancher-helm, zot, chartmuseum, kubescape, pluto, flux-source-controller, cluster-api-helm-controller,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, eksctl, chart-testing, helm-operator, zarf, kots, k9s, cilium-cli, helm-docs, flux-helm-controller, trivy, tw, helm-push, consul-k8s, flux, rancher-helm, zot, chartmuseum, kubescape, pluto, flux-source-controller, cluster-api-helm-controller,...

GHSA-5XQW-8HWV-WG92 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, eksctl, chart-testing, helm-operator, zarf, kots, k9s, cilium-cli, helm-docs, flux-helm-controller, trivy, tw, helm-push, consul-k8s, flux, rancher-helm, zot, chartmuseum, kubescape, pluto, flux-source-controller, cluster-api-helm-controller,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: dagger, k8ssandra-client, opa-envoy, opa, eksctl, helm-operator, nerdctl, newrelic-infrastructure-agent, zarf, docker-cli-buildx, kubevela, k8sgpt, ctop, kots, rancher-fleet, linkerd2, cilium-cli, flux-helm-controller, grype, helm, wolfictl, buildkitd, trivy,...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: beats, chainctl, fuse-overlayfs-snapshotter, docker, helm-operator-fips, trivy, trivy-fips, buildkitd-fips, cert-manager-cmctl-fips, neuvector, docker-fips, melange, opa-fips-envoy, helm-fips, beats-fips, kubescape, flux-helm-controller-fips, consul-k8s-fips,...

CVE-2024-40635 vulnerabilities

Vulnerabilities for packages: beats, chainctl, fuse-overlayfs-snapshotter, docker, helm-operator-fips, trivy, trivy-fips, buildkitd-fips, cert-manager-cmctl-fips, neuvector, docker-fips, melange, opa-fips-envoy, helm-fips, beats-fips, kubescape, flux-helm-controller-fips, consul-k8s-fips,...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: fulcio, step, tempo, sops, step-ca, airflow, nuclei, ksops, tekton-chains, zarf, goreleaser, thanos, bank-vaults, flux-image-reflector-controller, k8sgpt, py3-cassandra-medusa, restic, opentelemetry-collector-contrib, hugo, cosign, argo-events, sigstore-scaffolding,...

GO-2024-2859 source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller

source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller...

CVE-2024-31216 source-controller leaks theAzure Storage SAS token into logs on connection errors

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to versi...