GO-2025-3830 vulnerabilities

Vulnerabilities for packages: buf, k9s, zarf, aws-otel-collector, osv-scanner, splunk-otel-collector, trivy, opentelemetry-collector-contrib, kargo, grype, zot, goreleaser, openfga, buildkitd, melange, buildah, docker-cli-buildx, wolfictl, spire-server, nerdctl, syft, tw, trufflehog, falcoctl,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, k9s, argo-workflows, zarf, pulumi-language-yaml, kubescape, osv-scanner, pulumi-kubernetes-operator, trivy, pulumi-language-dotnet, kargo, pulumi-language-java, src-fingerprint, teleport, nfpm, grype, gitaly, guac, nuclei, kaniko, zo...

GO-2026-5490 vulnerabilities

Vulnerabilities for packages: rclone, teleport, gitaly, external-secrets-operator, argo-cd, rancher-fleet, scorecard, flux, telegraf, syft, cerbos, terragrunt...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: rclone, teleport, gitaly, external-secrets-operator, argo-cd, rancher-fleet, scorecard, telegraf, syft, cerbos, terragrunt...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: buf, tkn, kubescape, trivy, kargo, ko, grype, kaniko, zot, aactl, buildkitd, up, melange, cilium-cli, wolfictl, syft, spire-server, ctop, dagger, cadvisor, crossplane, conftest, docker-compose...

GO-2026-5105 vulnerabilities

Vulnerabilities for packages: act, flux-image-automation-controller, k9s, argo-workflows, zarf, pulumi-language-yaml, kubescape, osv-scanner, pulumi-kubernetes-operator, trivy, pulumi-language-dotnet, kargo, pulumi-language-java, src-fingerprint, teleport, grype, gitaly, guac, nuclei, kaniko, zot...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, k9s, crossplane-provider-aws-kinesis, zarf, go-discover, kubescape, external-dns, osv-scanner, ksops, crossplane-provider-aws-cloudformation, trivy, gitlab-kas, chisel, ko, teleport, rancher-machine, terraform-provider-azurerm,...

GO-2026-5006 vulnerabilities

Vulnerabilities for packages: k9s, zarf, go-discover, kubescape, external-dns, osv-scanner, trivy, gitlab-kas, gomplate, istio, terragrunt, melange, buildah, knative-serving, containerd, docker-cli-buildx, loki, cert-manager, witness, syft, scorecard, argocd-image-updater,...

CLEANSTART-2026-WA93687 Security fixes in syft 1.39.0-r0

Package syft version 1.39.0-r0 fixes 5 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2026-25934...

CLEANSTART-2026-LO95045 Security fixes in syft 1.39.0-r3

Package syft version 1.39.0-r3 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-BR47007 Security fixes in syft 1.42.4-r0

Package syft version 1.42.4-r0 fixes 11 vulnerabilities: CVE-2026-34165, CVE-2026-33762, CVE-2026-34986, CVE-2026-4660, CVE-2026-39883...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.49.0-0.1.hum1 aarch64, x8664 syft-1.49.0-0.1.hum1.src src...

MAL-2026-10767 Malicious code in syft-acp-util (npm)

The syft-acp-util package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

CLEANSTART-2026-KO23583 Security fixes for CVE-2025-15558, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-25934, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-39883, CVE-2026-4660, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-gm2x-2g9h-ccm8, ghsa-hfvc-g4fc-pqhx, ghsa-jhf3-xxhw-2wpp, ghsa-q9hv-hpm4-hj6x, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.39.0-r0, 1.39.0-r1, 1.39.0-r2, 1.39.0-r3, 1.42.4-r0

Multiple security vulnerabilities affect the syft package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.46.0-0.1.hum1 aarch64, x8664 syft-1.46.0-0.1.hum1.src src...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, knative-kafka-broker, external-secrets-fips, frankenphp-8.4, pulumi-language-dotnet, zot, crossplane-provider-aws-rds, gitlab-rails-ce-fips, guac, crossplane-provider-aws-elbv2-fips, crossplane-provider-aws-macie2, terraform-provider-acme,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: argo-cd-fips, knative-kafka-broker, external-secrets-fips, frankenphp-8.4, pulumi-language-dotnet, zot, crossplane-provider-aws-rds, gitlab-rails-ce-fips, guac, crossplane-provider-aws-elbv2-fips, crossplane-provider-aws-macie2, terraform-provider-acme,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: argo-cd-fips, knative-kafka-broker, kubescape, grafana, nemo, frankenphp-8.4, snyk-cli, argo-workflows-fips, pulumi-language-dotnet, cloudbeat-fips, zot, argo-cd, calico-fips, gitlab-rails-ce-fips, tekton-pipelines-fips, kyverno, guac, skaffold, grype, kubernetes-fip...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: k9s, zarf, go-discover, kubescape, external-dns, osv-scanner, trivy, gitlab-kas, gomplate, istio, terragrunt, melange, buildah, knative-serving, containerd, docker-cli-buildx, loki, cert-manager, witness, syft, scorecard, argocd-image-updater,...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: crossplane-fips, kubescape, xeol-fips, cloudbeat-fips, zot, fuse-overlayfs-snapshotter, beats-fips, cluster-api-helm-controller-fips, gitlab-rails-ce-fips, tekton-pipelines-fips, neuvector-scanner, cluster-api-helm-controller, chaos-mesh-fips, skaffold, grype,...