GO-2023-2379 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, falcoctl, gitsign, tekton-chains, cosign-fips, kubescape, vexctl...

GO-2024-2454 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, falcoctl, mc, spire-server-fips, spire-server, gitsign, tekton-chains, boring-registry, vexctl, cosign-fips, external-secrets-fips, kubescape, minio...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: melange, goreleaser, flux-source-controller, apko, ko-fips, tkn-fips, policy-controller, ko, gitsign, slsa-verifier, policy-controller-fips, spire-server, aactl, skaffold, falcoctl-fips, spire-server-fips, chainctl, kubescape, vexctl, neuvector-sigstore-interface,...

GO-2023-2379 vulnerabilities

Vulnerabilities for packages: tekton-chains, kubescape, falcoctl, gitsign, vexctl...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: spire-server, witness, neuvector-sigstore-interface, zot, tkn, trivy-operator, buildkitd, kubescape, trivy, ko, gitsign, goreleaser, tflint, kyverno-notation-aws, sigstore-scaffolding, vexctl, policy-controller, skaffold, gh, zarf, tekton-chains, cosign, teleport,...

GO-2024-2454 vulnerabilities

Vulnerabilities for packages: spire-server, minio, kubescape, tekton-chains, boring-registry, falcoctl, gitsign, vexctl, mc...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: spire-server, flux-kustomize-controller, argo-workflows, cloudflared, tkn, slsa-verifier, kubescape, sops, rekor, gitsign, fulcio, terragrunt, kots, vexctl, dex, tekton-chains, cosign, flux-source-controller, oauth2-proxy, aactl...

GO-2026-4311 vulnerabilities

Vulnerabilities for packages: zarf, kubescape, tekton-chains, witness, cosign, kots, falcoctl, falco-no-driver, skopeo, gitsign, sigstore-scaffolding, slsa-verifier, vexctl, aactl...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: spire-server, witness, neuvector-sigstore-interface, zot, tkn, kubescape, docker-cli-buildx, ko, gitsign, goreleaser, tflint, kyverno-notation-aws, sigstore-scaffolding, vexctl, policy-controller, skaffold, gh, zarf, tekton-chains, cosign, teleport,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: spire-server, witness, neuvector-sigstore-interface, zot, tkn, trivy-operator, slsa-verifier, buildkitd, kubescape, trivy, docker-cli-buildx, kyverno, ko, gitsign, goreleaser, tflint, kyverno-notation-aws, sigstore-scaffolding, vexctl, policy-controller, skaffold, gh...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: spire-server, witness, neuvector-sigstore-interface, zot, tkn, trivy-operator, slsa-verifier, buildkitd, kubescape, trivy, ko, rekor, gitsign, goreleaser, tflint, kyverno-notation-aws, sigstore-scaffolding, vexctl, policy-controller, skaffold, gh, zarf, tekton-chains...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: spire-server, snyk-cli, flux-kustomize-controller, opentelemetry-collector, src-fingerprint, neuvector-sigstore-interface, pulumi, zot, crossplane-provider-azure-managedidentity, ksops, tkn, gomplate, grafana-mimir, slsa-verifier, scorecard, terraform, rook, buildkit...

openSUSE 16 Security Update : vexctl (openSUSE-SU-2026:21481-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21481-1 advisory. - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto...

OPENSUSE-SU-2026:21481-1 Security update for vexctl

This update for vexctl fixes the following issues: - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto bsc1234486. - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, go-discover, delve, litestream, flannel, grpcurl, spegel, cloud-provider-vsphere, aws-node-termination-handler, terraform-provider-sendgrid, tkn, golangci-lint, caddy, grafana-agent-operator, kyverno-policy-reporter-kyverno-plugin,...

CVE-2025-15558 vulnerabilities

Vulnerabilities for packages: spire-server, flux-kustomize-controller, argo-workflows, minio-operator, dagdotdev, kbld, witness, bento, nerdctl, zot, istio, eksctl, trivy-operator, slsa-verifier, scorecard, vitess, xeol, traefik, rancher-fleet, kargo, kubescape-operator, trivy, vcluster,...

GHSA-P436-GJF2-799P vulnerabilities

Vulnerabilities for packages: spire-server, flux-kustomize-controller, argo-workflows, minio-operator, dagdotdev, kbld, witness, bento, nerdctl, zot, istio, eksctl, trivy-operator, slsa-verifier, scorecard, vitess, xeol, traefik, rancher-fleet, kargo, kubescape-operator, trivy, vcluster,...

GHSA-P436-GJF2-799P vulnerabilities

Vulnerabilities for packages: trivy-operator, vendir, vault-secrets-webhook, kyverno-fips, guac, flux-helm-controller, traefik, vcluster, vendir-fips, k3d, ko, gitsign, teleport, flux-kustomize-controller, policy-controller-fips, crossplane-fips, harbor, aactl, argo-workflows-fips,...

CVE-2025-15558 vulnerabilities

Vulnerabilities for packages: trivy-operator, vendir, vault-secrets-webhook, kyverno-fips, guac, flux-helm-controller, traefik, vcluster, vendir-fips, k3d, ko, gitsign, teleport, flux-kustomize-controller, policy-controller-fips, crossplane-fips, harbor, aactl, argo-workflows-fips,...

Security update for vexctl

This update for vexctl fixes the following issues: Update to version 0.4.1+git78.f951e3a: CVE-2025-22868: Unexpected memory consumption during token parsing in golang.org/x/oauth2. bsc1239186 CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in...