GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step-issuer, step-ca, caddy, step...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: cloudflared, kyverno-policy-reporter-ui, buf, gitness, rclone, karma, step-issuer, step-ca, tkn, caddy, gogatekeeper, sftpgo, step...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-exporter, cert-manager-cmctl, step-issuer...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-istio-csr, opentelemetry-operator, cert-manager-cmctl, step-issuer, cert-manager-csi-driver, mariadb-operator...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: step-ca, caddy, argo-workflows, trillian, kots, step...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: spark-operator, flyte, terraform-provider-google, grafana-mimir, amass, kubeflow, pulumi-language-dotnet, pulumi, skaffold, flux-image-reflector-controller, step-issuer, sriov-network-device-plugin, opa, kyverno-notation-aws, dgraph, cluster-proportional-autoscaler,...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: src, trillian, amass, kube-bench, k3s, temporal-server, kine, step-ca, caddy, argo-workflows, spicedb, ferretdb, kots, step...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flux, flyte, sops, argo-events, py3-cassandra-medusa, grafana-mimir, goreleaser, k8sgpt, sqlpad, wal-g, tekton-chains, pulumi, airflow, buildkitd, restic, falcoctl, guac, opentelemetry-collector-contrib, chezmoi, rekor, cortex, nuclei, thanos, zot, terragrunt,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: sops, kaf, argo-events, snyk-cli, terraform-provider-azapi, pulumi-language-dotnet, crossplane-provider-aws-route53, k3s, dagger, grype, teleport, cloudflared, mattermost, crossplane-provider-azure-managedidentity, neuvector-sigstore-interface, src,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: sops, rancher-system-agent, kubeflow, k3s, whereabouts, dask-gateway, descheduler, kustomize, kuberay-operator, conftest, litestream, extism, mattermost, neuvector-sigstore-interface, src, crossplane-provider-aws-ec2, hubble-ui, aws-privateca-issuer,...

GO-2026-4503 vulnerabilities

Vulnerabilities for packages: sops, minio, croc, sqlexporter, trufflehog, aactl, amass, splunk-otel-collector, dbmate, k3s, witness, mariadb-operator, step, jitsucom-bulker, chezmoi, kots, rekor, cerbos, mattermost, ratify, kyverno-policy-reporter, nuclei, terragrunt, juicefs, timestamp-authority...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: argo-events, pluto, rancher-system-agent, terraform-provider-azapi, k3s, nats-server-config-reloader, conftest, nri-memcached, src, neuvector-sigstore-interface, aws-privateca-issuer, kubernetes-csi-external-health-monitor, chart-testing, ipfs-cluster,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux, sops, crossplane-provider-azure, argo-events, grafana-mimir, goreleaser, aactl, snyk-cli, tekton-chains, k3s, pulumi, gomplate, buildkitd, skopeo, vexctl, falcoctl, guac, k3d, opentelemetry-collector-contrib, rekor, crossplane-provider-azure-managedidentity,...

CVE-2026-72851

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CLEANSTART-2026-HR84779 Security fixes in step-ca-fips 0.30.2-r1

Package step-ca-fips version 0.30.2-r1 fixes 16 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CVE-2026-73083 Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

CVE-2026-73081

CVE-2026-73081 affects Activepieces prior to 0.80.0. The worker’s code-compilation pipeline creates the on-disk path for a Code step from the step name and passes it to a shell-invoked build command. A step name containing shell metacharacters can break out of the intended build invocation, allow...

CVE-2026-73081 Activepieces: Remote Code Execution via Command Injection in Code Step Name

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

CVE-2026-73081 Activepieces: Remote Code Execution via Command Injection in Code Step Name

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

RLSA-2026:38509 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...