CLEANSTART-2026-KO23583 Security fixes for CVE-2025-15558, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25934, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-39883, CVE-2026-4660, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-gm2x-2g9h-ccm8, ghsa-hfvc-g4fc-pqhx, ghsa-jhf3-xxhw-2wpp, ghsa-q9hv-hpm4-hj6x, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.39.0-r0, 1.39.0-r1, 1.39.0-r2, 1.39.0-r3, 1.42.4-r0

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.46.0-0.1.hum1 aarch64, x8664 syft-1.46.0-0.1.hum1.src src...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: grype-fips, scorecard, guac, zarf, flux-fips, frankenphp-8.4, flux-source-controller-fips, argo-events, gitea, gitlab-rails-ce-fips, mattermost-fips, prometheus-elasticsearch-exporter, kuma, kubescape, nerdctl, podman, grype, cilium, juicefs, argo-cd-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: scorecard, crossplane-provider-aws-cloudformation-fips, crossplane-provider-aws-osis-fips, flux-source-controller-fips, crossplane-provider-azure-sql, crossplane-provider-aws-chime, crossplane-provider-aws-sns, crossplane-provider-azure-resources, sealed-secrets,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: scorecard, crossplane-provider-aws-cloudformation-fips, crossplane-provider-aws-osis-fips, flux-source-controller-fips, crossplane-provider-azure-sql, crossplane-provider-aws-chime, crossplane-provider-aws-sns, crossplane-provider-azure-resources, sealed-secrets,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: pulumi, helm, minio, opentofu, loki, nfpm, caddy, terragrunt, aactl, nerdctl, pulumi-language-dotnet, trivy, kots, k3s, step-kms-plugin, flux, melange, step-issuer, external-secrets-operator, knative-serving, containerd, kine, pulumi-language-java, kubernetes, podman...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: grype-fips, scorecard, teleport, zarf, kube-arangodb, kube-mgmt-fips, xeol-fips, neuvector, gitlab-rails-ce-fips, kubescape, grype, cluster-api-helm-controller-fips, crossplane, kube-arangodb-fips, cloudbeat, tekton-pipelines, chartmuseum-fips, trivy-operator-fips,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: grype-fips, scorecard, teleport, zarf, kube-arangodb, kube-mgmt-fips, xeol-fips, neuvector, gitlab-rails-ce-fips, kubescape, grype, cluster-api-helm-controller-fips, crossplane, kube-arangodb-fips, cloudbeat, tekton-pipelines, chartmuseum-fips, trivy-operator-fips,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: grype-fips, scorecard, teleport, zarf, kube-arangodb, kube-mgmt-fips, xeol-fips, neuvector, gitlab-rails-ce-fips, kubescape, grype, cluster-api-helm-controller-fips, crossplane, kube-arangodb-fips, cloudbeat, tekton-pipelines, chartmuseum-fips, trivy-operator-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: grype-fips, scorecard, teleport, zarf, kube-arangodb, kube-mgmt-fips, xeol-fips, neuvector, gitlab-rails-ce-fips, kubescape, grype, cluster-api-helm-controller-fips, crossplane, kube-arangodb-fips, cloudbeat, chartmuseum-fips, trivy-operator-fips, neuvector-scanner,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

GHSA-RGH6-RFWX-V388 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, fuse-overlayfs-snapshotter, helm, kubevela, zot, helm-mapkubeapis, neuvector-scanner, helm-operator, helm-push, kargo, eksctl, docker, zarf, envoy-gateway, chartmuseum, docker-cli-buildx, headlamp, ctop, docker-compose, syft, gatekeeper,...