GO-2026-5597 vulnerabilities

Vulnerabilities for packages: terragrunt, teleport, rclone, telegraf, cerbos, scorecard, external-secrets-operator, gitaly, argo-cd, rancher-fleet, syft...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: osv-scanner, nuclei, k9s, trivy-operator, kubevela, wolfictl, pulumi-kubernetes-operator, zot, grype, syft, flux-source-controller, argo-events, gptscript, crossplane, kots, src-fingerprint, teleport, skaffold, apko, argo-workflows, cerbos, gitea, dagger,...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: wolfictl, grype, crossplane, dagger, docker-compose, ko, kubescape, spire-server, cilium-cli, aactl, buf, tkn, buildkitd, trivy, up, conftest, cadvisor, melange, kaniko, ctop, zot, syft, kargo...

GO-2026-5105 vulnerabilities

Vulnerabilities for packages: osv-scanner, nuclei, k9s, trivy-operator, kubevela, wolfictl, pulumi-kubernetes-operator, zot, grype, syft, flux-source-controller, argo-events, gptscript, crossplane, kots, src-fingerprint, terragrunt, teleport, skaffold, apko, argo-workflows, cerbos, gitea, dagger,...

GO-2026-5006 vulnerabilities

Vulnerabilities for packages: k9s, kubernetes-dashboard, grype, mattermost, gptscript, terragrunt, gitea, loki, act, kubernetes, fscrypt, witness, flux-image-automation-controller, telegraf, pulumi, knative-serving, prometheus, melange, openbao, trivy-operator, wolfictl, pulumi-kubernetes-operato...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: cosign, crossplane-provider-aws-ec2, docker, k9s, falcoctl, fulcio, kubernetes-dashboard, grype, mattermost, crossplane-provider-azure-storage, gptscript, flux-notification-controller, hcloud, crossplane-provider-aws-sns, terragrunt, tekton-chains, gitea, loki, act,...

CLEANSTART-2026-BR47007 Security fixes in syft 1.42.4-r0

Package syft version 1.42.4-r0 fixes 11 vulnerabilities: CVE-2026-34165, CVE-2026-33762, CVE-2026-34986, CVE-2026-4660, CVE-2026-39883...

CLEANSTART-2026-WA93687 Security fixes in syft 1.39.0-r0

Package syft version 1.39.0-r0 fixes 5 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2026-25934...

CLEANSTART-2026-LO95045 Security fixes in syft 1.39.0-r3

Package syft version 1.39.0-r3 fixes 1 vulnerabilities: CVE-2026-33186...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.49.0-0.1.hum1 aarch64, x8664 syft-1.49.0-0.1.hum1.src src...

MAL-2026-10767 Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

CLEANSTART-2026-KO23583 Security fixes for CVE-2025-15558, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25934, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-39883, CVE-2026-4660, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-gm2x-2g9h-ccm8, ghsa-hfvc-g4fc-pqhx, ghsa-jhf3-xxhw-2wpp, ghsa-q9hv-hpm4-hj6x, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.39.0-r0, 1.39.0-r1, 1.39.0-r2, 1.39.0-r3, 1.42.4-r0

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.46.0-0.1.hum1 aarch64, x8664 syft-1.46.0-0.1.hum1.src src...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme, crossplane-provider-aws-emr-fips, argo-events, gatus-fips, step-issuer, cg, frankenphp-8.5, crossplane-provider-aws-networkmanager, crossplane-provider-aws-vpc, crossplane-provider-azure-securityinsights, kube-conformance, livekit-cli,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: terraform-provider-acme, crossplane-provider-aws-emr-fips, argo-events, gatus-fips, step-issuer, cg, frankenphp-8.5, crossplane-provider-aws-networkmanager, crossplane-provider-aws-vpc, crossplane-provider-azure-securityinsights, kube-conformance, livekit-cli,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: buildah, pulumi-language-java, argo-events-fips, argo-events, cloudbeat-fips, etcd, cg, knative-kafka-broker-fips, prometheus-mongodb-exporter, frankenphp-8.5, step-issuer, trivy-fips, kube-conformance, prometheus-operator, kuma, upwind-agent, fscrypt, kubernetes,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: k9s, kubernetes-dashboard, grype, mattermost, gptscript, terragrunt, gitea, loki, act, kubernetes, fscrypt, witness, flux-image-automation-controller, telegraf, pulumi, knative-serving, prometheus, melange, openbao, trivy-operator, wolfictl, pulumi-kubernetes-operato...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: harvester, neuvector-scanner-fips, xeol-fips, fuse-overlayfs-snapshotter, cloudbeat-fips, trivy-fips, cg, kaniko, consul-k8s-fips, chartmuseum-fips, livekit-cli, ctop, teleport, grype-fips, zarf, redpanda-operator, skaffold, envoy-gateway, amazon-ecs-agent-fips,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: harvester, neuvector-scanner-fips, xeol-fips, fuse-overlayfs-snapshotter, cloudbeat-fips, trivy-fips, cg, kaniko, consul-k8s-fips, chartmuseum-fips, livekit-cli, ctop, teleport, grype-fips, zarf, redpanda-operator, skaffold, envoy-gateway, amazon-ecs-agent-fips,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: harvester, neuvector-scanner-fips, xeol-fips, fuse-overlayfs-snapshotter, cloudbeat-fips, trivy-fips, cg, kaniko, consul-k8s-fips, chartmuseum-fips, livekit-cli, ctop, teleport, grype-fips, zarf, redpanda-operator, skaffold, envoy-gateway, amazon-ecs-agent-fips,...