GHSA-JJRM-HR5F-673X Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...

Source controller: Improper path handling allows traversal

Impact An actor with the ability to influence the contents of a bucket referenced by a Bucket resource can cause source-controller to write fetched object data to paths outside the per-reconciliation working directory. The corruption surface is bounded by source-controller's own and downstream Fl...

PT-2026-47088

Name of the Vulnerable Software and Affected Versions source-controller versions prior to 1.8.5 Description Improper path handling allows for path traversal in two scenarios. First, an actor capable of influencing the contents of a bucket referenced by a Bucket resource can force the...

FlexRIC 安全漏洞

FlexRIC is an open-source RAN intelligent controller developed by Mosaic5G. The FlexRIC v2.0.0 version contains a security vulnerability. This vulnerability arises from trusting the xappid field in the trust E42 message without binding it to the sender’s SCTP association. As a result, remote...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: gptscript, trivy-operator, argo-cd, argocd-image-updater, melange, pulumi-kubernetes-operator, teleport, kubescape, nuclei, osv-scanner, dagger, nfpm, terragrunt, witness, kargo, k9s, external-secrets-operator, pulumi-language-yaml, tfsec,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: zarf, kargo, packer-fips, grype-db, trivy-fips, coder-fips, gptscript, tfsec, argo-workflows-fips, snyk-cli, kubescape-server-fips, coder, crossplane-fips, steampipe, rancher-fleet-fips, gitea-fips, crossplane, guac, trufflehog-fips, external-secrets-operator,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: spire-server, trivy-operator, docker, teleport, rekor, kubescape, docker-cli-buildx, aactl, dagger, vexctl, policy-controller, falcoctl, gh, guac, ratify, neuvector-sigstore-interface, zarf, skaffold, zot, flux-source-controller, buildkitd, tflint, gitlab-runner, tkn...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: vexctl, zarf, trivy-fips, spire-server, chainloop-control-plane, cosign-fips, kubescape-server-fips, docker-compose-fips, crossplane-fips, docker-fips, crossplane, guac, rekor-fips, kyverno-policy-reporter-plugins-kyverno, kubescape, zarf-fips, tkn-fips, teleport,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: spire-server, trivy-operator, docker, teleport, kubescape, docker-cli-buildx, aactl, vexctl, witness, policy-controller, falcoctl, gh, ratify, neuvector-sigstore-interface, zarf, skaffold, zot, flux-source-controller, buildkitd, tflint, tkn, kyverno-notation-aws,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: spire-server, trivy-operator, docker, teleport, kubescape, docker-cli-buildx, aactl, vexctl, witness, policy-controller, falcoctl, gh, ratify, neuvector-sigstore-interface, zarf, skaffold, zot, flux-source-controller, buildkitd, tflint, tkn, kyverno-notation-aws,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: spire-server, envoy-ratelimit, fluxcd-kustomize-mutating-webhook, volume-modifier-for-k8s, dgraph, ingress-nginx-controller, smarter-device-manager, flux-image-reflector-controller, karpenter, metacontroller, dbmate, pluto, omnibump, local-path-provisioner,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, kube-state-metrics, terraform-provider-azuread, etcd, spire-controller-manager, flannel, kubernetes, terraform-provider-tls, cloudnative-pg, terraform-provider-time, boring-registry, prometheus-pushgateway, nuclei, terraform-provider-kubernetes,...

CVE-2025-47914 vulnerabilities

Vulnerabilities for packages: kuma, argocd-image-updater, cert-manager-webhook-pdns, gogatekeeper, etcd, kube-state-metrics, crossplane-provider-aws-elasticache, flannel, kubernetes, q, cloudnative-pg, terraform-provider-tls, boring-registry, prometheus-pushgateway, gitleaks,...

GHSA-J5W8-Q4QC-RX2X vulnerabilities

Vulnerabilities for packages: kuma, argocd-image-updater, cert-manager-webhook-pdns, gogatekeeper, etcd, kube-state-metrics, crossplane-provider-aws-elasticache, flannel, kubernetes, q, cloudnative-pg, boring-registry, prometheus-pushgateway, gitleaks, flux-image-reflector-controller,...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: kuma, argocd-image-updater, cert-manager-webhook-pdns, gogatekeeper, etcd, kube-state-metrics, crossplane-provider-aws-elasticache, flannel, kubernetes, q, cloudnative-pg, terraform-provider-tls, boring-registry, prometheus-pushgateway, gitleaks,...

CVE-2025-58181 vulnerabilities

Vulnerabilities for packages: kuma, argocd-image-updater, cert-manager-webhook-pdns, gogatekeeper, etcd, kube-state-metrics, crossplane-provider-aws-elasticache, flannel, kubernetes, q, cloudnative-pg, boring-registry, prometheus-pushgateway, gitleaks, flux-image-reflector-controller,...

CVE-2025-9148 CodePhiliaX Chat2DB JDBC Connection DataSourceController.java sql injection

A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects an unknown function of the file ai/chat2db/server/web/api/controller/data/source/DataSourceController.java of the component JDBC Connection Handler. The manipulation results in sql injection. The attack can be executed...

PT-2025-33817 · Unknown · Codephiliax Chat2Db

Name of the Vulnerable Software and Affected Versions: CodePhiliaX Chat2DB versions through 0.3.7 Description: A SQL injection issue exists in the JDBC Connection Handler component of CodePhiliaX Chat2DB. The issue affects an unknown function within the...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: cilium-fips, caddy, sbom-convert, vault-secrets-operator, eck-operator, neuvector-dbgen-fips, cert-manager, go-md2man, cloud-provider-azure-fips, terraform-provider-kubernetes, sftpgo-plugin-eventsearch, kbld, rke2-cloud-provider, amazon-k8s-cni,...

CVE-2024-31216

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to versi...