GO-2024-2978 vulnerabilities

Vulnerabilities for packages: k3d, restic, k3s, osv-scanner, cilium-cli, sigstore-scaffolding, cloudnative-pg, grpc-health-probe, tflint, dagger, k8sgpt, falcosidekick, guac, fulcio, pulumi-language-dotnet, rqlite, terraform-provider-google, zarf, step-ca, ksops, terraform-docs, opa,...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: caddy, step-issuer, step, step-ca...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: caddy, step-issuer, step, step-ca...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: rclone, cloudflared, step, gogatekeeper, gitness, sftpgo, caddy, step-issuer, buf, karma, tkn, kyverno-policy-reporter-ui, step-ca...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: argo-workflows, step, caddy, trillian, kots, step-ca...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: ferretdb, argo-workflows, temporal-server, step, k3s, kube-bench, caddy, kine, trillian, kots, amass, spicedb, src, step-ca...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: rclone, harbor-registry, druid, restic, timestamp-authority, rook, secrets-store-csi-driver-provider-azure, buildkitd, sigstore-scaffolding, wal-g, k8sgpt, kubescape, guac, boring-registry, fulcio, py3-azure-identity, tekton-chains, tkn, step-ca, ksops, zarf, sqlpad,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: k3d, terraform-provider-azurerm, actions-runner-controller, flux-image-automation-controller, scorecard, k3s, timestamp-authority, rook, kubevela, buildkitd, sigstore-scaffolding, flux-helm-controller, kubescape, guac, fulcio, glab, skopeo, tkn, tekton-chains, zarf,...

CLEANSTART-2026-HR84779 Security fixes in step-ca-fips 0.30.2-r1

Package step-ca-fips version 0.30.2-r1 fixes 16 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-NI95810 Security fixes in step-ca-fips 0.29.0-r0

Package step-ca-fips version 0.29.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, ghsa-mqqf-5wvp-8fh8...

CLEANSTART-2026-HH86881 Security fixes in step-ca-fips 0.29.0-r1

Package step-ca-fips version 0.29.0-r1 fixes 2 vulnerabilities: CVE-2026-26958, ghsa-fw7p-63qq-7hpr...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: kueue-fips, mc, crossplane-provider-aws-resourcegroups-fips, manifest-tool, opa, crossplane-provider-aws-route53resolver-fips, filebrowser, crossplane-provider-aws-fsx, ferretdb, crossplane-provider-aws-kafkaconnect, virt-launcher, ceph-csi-operator-fips,...

GO-2026-5297 Step CA affected by an index out of bounds panic in TPM attestation EKU validation in github.com/smallstep/certificates

Step CA affected by an index out of bounds panic in TPM attestation EKU validation in github.com/smallstep/certificates...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: openbao-fips, step, commercial-expanso-edge, gitlab-cng, cloudnative-pg-fips, kuma, ferretdb, k3s, authentik-fips, step-issuer-fips, commercial-chainloop-backend, argo-workflows, caddy-fips, openfga, spire-server-fips, azure-service-operator, sftpgo-plugin-eventstore...

SUSE CVE-2026-40097

Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: rclone, sftpgo-plugin-eventstore, vault-secrets-webhook, db-operator, vault-env, cilium-cli, kube-fluentd-operator, x509-certificate-exporter, caddy, harbor, promxy, boring-registry, grafana-rollout-operator, weaviate, yunikorn-k8shim, ingress-nginx-controller, tkn,...

GHSA-9QQ8-CGCV-QMC9 Step CA affected by an index out of bounds panic in TPM attestation EKU validation

Summary An attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension during TPM device attestation. Details When processing a device-attest-01 ACME challenge using TPM attestation, Step CA...

CVE-2026-40097

Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension...

CVE-2026-40097

Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension...

CVE-2026-40097 Step CA affected by an index out of bounds panic in TPM attestation EKU validation

Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension...