GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step-ca-fips, step-fips, step-issuer-fips, caddy, step, caddy-fips, step-ca, step-issuer...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: dapr, step-ca-fips, kyverno-policy-reporter-ui-fips, tkn-fips, step, buf, rclone, caddy, step-issuer, gitness, cloudflared, rclone-fips, step-issuer-fips, tkn, caddy-fips, dapr-fips, karma, step-fips, gogatekeeper, telegraf, kyverno-policy-reporter-ui, sftpgo, step-c...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step-ca-fips, step-fips, step-issuer-fips, caddy, step, caddy-fips, step-ca, step-issuer...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: step-ca-fips, frankenphp-8.2, frankenphp-8.5, step-issuer-fips, caddy, caddy-fips, frankenphp-8.4, frankenphp-8.3...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: trillian-fips, argo-workflows-fips, kots, argo-workflows, caddy, trillian, caddy-fips, step, step-ca, wavefront-collector-for-kubernetes...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: amass, step-ca-fips, pulumi-language-yaml, opa-fips, kyverno-notation-aws-fips, dgraph, pulumi-language-java, step, pulumi-language-dotnet, crossplane-provider-gcp, terraform-provider-google, kyverno-fips, opa, kyverno-notation-aws, pulumi, smarter-device-manager-fip...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, dbmate, kubernetes-csi-external-provisioner, ksops, grafana-agent-operator, fulcio, cilium-cli, gomplate, kubernetes-csi-driver-hostpath, vcluster, certificate-transparency, ferretdb, kots, step-ca, melange, temporal, step, zot, hubble-ui, minio...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step-ca, caddy, step, step-issuer...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step-ca, caddy, step, step-issuer...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: gogatekeeper, step, rclone, tkn, buf, karma, gitness, sftpgo, caddy, kyverno-policy-reporter-ui, cloudflared, step-ca, step-issuer...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: step, trillian, caddy, kots, argo-workflows, step-ca...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: k3s, amass, kine, step, trillian, temporal-server, caddy, ferretdb, kube-bench, kots, spicedb, argo-workflows, src, step-ca...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, ksops, wal-g, tekton-chains, grafana-agent-operator, fulcio, hugo, harbor-registry, rekor, up, trino, argo-workflows, hugo-extended, flux-kustomize-controller, timestamp-authority, step, zot, flux, nuclei, trivy, cosign, thanos,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, snyk-cli, ksops, tekton-chains, terraform, fulcio, rekor, gomplate, actions-runner-controller, flux-image-automation-controller, kubernetes-event-exporter, crossplane-provider-azure-authorization, slsa-verifier, step-ca, flux-kustomize-controlle...

CLEANSTART-2026-NI95810 Security fixes in step-ca-fips 0.29.0-r0

Package step-ca-fips version 0.29.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, ghsa-mqqf-5wvp-8fh8...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: jaeger-operator-fips, tetragon, crossplane-provider-aws-globalaccelerator, consul-k8s, crossplane-provider-aws-s3, k8s-metacollector-fips, opentelemetry-collector-k8s, pvc-autoresizer-fips, dagdotdev, chainloop-cli, opentelemetry-collector-k8s-fips,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: amass, trillian-fips, openfga, keda, spire-server, temporal-server-fips, seaweedfs-rocksdb, falcosidekick, grafana-fips, temporal-fips, gitness, pgtimetable, cerbos, steampipe, cloudnative-pg-fips, bento, sftpgo-plugin-eventsearch, goose-fips, trillian, caddy-fips,...

SUSE CVE-2026-40097

Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, snyk-cli, kubescape-operator, nginx-prometheus-exporter, docker-credential-gcr, terraform-provider-aws, grafana-agent-operator, trillian, helm-mapkubeapis, kubernetes-csi-driver-hostpath, chartmuseum, certificate-transparency, sftpgo-plugin-auth...

GHSA-9QQ8-CGCV-QMC9 Step CA affected by an index out of bounds panic in TPM attestation EKU validation

Summary An attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension during TPM device attestation. Details When processing a device-attest-01 ACME challenge using TPM attestation, Step CA...