GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step, caddy, step-issuer, step-issuer-fips, step-ca, step-fips, caddy-fips, step-ca-fips...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step, caddy, step-issuer, step-issuer-fips, step-ca, step-fips, caddy-fips, step-ca-fips...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: rclone, cloudflared, kyverno-policy-reporter-ui-fips, step-issuer, caddy, tkn, karma, gitness, sftpgo, telegraf, caddy-fips, step, step-ca, buf, step-ca-fips, gogatekeeper, dapr-fips, tkn-fips, kyverno-policy-reporter-ui, rclone-fips, dapr, step-fips, step-issuer-fip...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: caddy, step-issuer-fips, frankenphp-8.2, frankenphp-8.5, frankenphp-8.3, frankenphp-8.4, caddy-fips, step-ca-fips...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, caddy, step, trillian, argo-workflows, kots, trillian-fips, step-ca, wavefront-collector-for-kubernetes, caddy-fips...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: grafana-mimir, portieris-fips, sigstore-scaffolding, portieris, google-osconfig-agent, kube-bench-fips, smarter-device-manager-fips, sriov-network-device-plugin, nfs-subdir-external-provisioner-fips, skaffold, amass, caddy, step-issuer, kyverno, opa-envoy,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dagger, rqlite, dbmate, opa, conftest, k3s, sigstore-scaffolding, kots, trivy, spicedb, step-ca, step, terraform-provider-google, terraform-docs, opentelemetry-collector, osv-scanner, k8sgpt-operator, zarf, grafana-agent-operator, grafana-mimir, k8sgpt, kaniko,...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step-issuer, caddy, step-ca, step...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step-issuer, caddy, step-ca, step...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: rclone, cloudflared, step-issuer, gogatekeeper, karma, step, sftpgo, tkn, gitness, kyverno-policy-reporter-ui, buf, caddy, step-ca...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: step, trillian, argo-workflows, kots, caddy, step-ca...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: amass, src, step, k3s, kube-bench, trillian, ferretdb, spicedb, argo-workflows, kine, kots, caddy, step-ca, temporal-server...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: argo-events, goreleaser, rook, buildkitd, py3-cassandra-medusa, flyte, kubescape, sigstore-scaffolding, trivy, flux, airflow, flux-source-controller, hugo-extended, cosign, nuclei, cortex, fluent-bit-plugin-loki, policy-controller, sqlpad, step-ca, step,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: argo-events, goreleaser, crossplane-provider-family-azure, scorecard, flux-image-automation-controller, rook, buildkitd, kubevela, k3s, actions-runner-controller, crossplane-provider-azure-authorization, kubescape, snyk-cli, sigstore-scaffolding, terraform, vexctl,...

CLEANSTART-2026-HR84779 Security fixes in step-ca-fips 0.30.2-r1

Package step-ca-fips version 0.30.2-r1 fixes 16 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-NI95810 Security fixes in step-ca-fips 0.29.0-r0

Package step-ca-fips version 0.29.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, ghsa-mqqf-5wvp-8fh8...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: go-msft, commercial-expanso-edge, opentelemetry-collector-k8s, athenz-csi-driver, crossplane-provider-aws-route53recoveryreadiness-fips, azure-service-operator-fips, apm-server, crossplane-provider-aws-cognitoidentity-fips, crossplane-provider-aws-batch-fips,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: wal-g, commercial-expanso-edge, goose-fips, openfga, trillian-fips, azure-service-operator-fips, harbor-fips, jitsucom-bulker, cloudnative-pg, cloudprober, cerbos, grafana-alloy-fips, harbor, steampipe, keda, spicedb, src, seaweedfs-fips, telegraf, ory-kratos-fips,...

SUSE CVE-2026-40097

Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: goreleaser, descheduler, docker-machine-driver-harvester, kube-fluentd-operator, net-kourier, snyk-cli, crossplane-provider-azure-authorization, sftpgo, docker-cli, crossplane, kyverno-policy-reporter-ui, aws-flb-cloudwatch, verticadb-operator, flux, policy-controlle...