GO-2026-4311 vulnerabilities

Vulnerabilities for packages: falcoctl, kubescape, cosign, falco-no-driver, gitsign, skopeo, vexctl, witness, zarf, aactl, sigstore-scaffolding, tekton-chains, kots, slsa-verifier...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: falcoctl, cosign, docker-cli-buildx, vexctl, witness, policy-controller, docker, trivy, slsa-verifier, tkn, ratify, teleport, flux-source-controller, neuvector-sigstore-interface, zarf, zot, gh, kyverno, buildkitd, kubescape, tflint, kyverno-notation-aws, gitsign,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: falcoctl, cosign, vexctl, witness, policy-controller, docker, trivy, slsa-verifier, tkn, ratify, teleport, flux-source-controller, neuvector-sigstore-interface, zarf, zot, gh, kyverno, buildkitd, kubescape, tflint, kyverno-notation-aws, gitsign, skaffold, aactl,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, gomplate, rabbitmq-messaging-topology-operator, snyk-cli, falcoctl, cosign, crossplane-provider-azure-authorization, k3s, kubernetes-event-exporter, timestamp-authority, flux-image-reflector-controller, flux-kustomize-controller, vexctl,...

SUSE CVE-2026-40090

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

GO-2026-5542 Path traversal via malicious package name in github.com/zarf-dev/zarf

A path traversal vulnerability in Zarf allows an attacker to write arbitrary files on the host system by providing a malicious package name in the package metadata. This occurs when Zarf generates SBOM or documentation outputs, or when creating a package, as it fails to properly sanitize the...

GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities

Vulnerabilities for packages: tflint-fips, kyverno, ratify, crossplane, trivy-fips, spire-server-fips, tekton-chains, teleport-operator-fips, policy-controller-fips, tbot, crossplane-fips, gitsign, kubescape, falcoctl, neuvector-sigstore-interface-fips, tkn-fips, trivy-operator, teleport,...

CVE-2026-49834 vulnerabilities

Vulnerabilities for packages: tflint-fips, kyverno, ratify, crossplane, trivy-fips, spire-server-fips, tekton-chains, teleport-operator-fips, policy-controller-fips, tbot, crossplane-fips, gitsign, kubescape, falcoctl, neuvector-sigstore-interface-fips, tkn-fips, trivy-operator, teleport,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: beats-fips, cluster-autoscaler-fips, kube-state-metrics, mattermost-fips, chainloop-cli-fips, k8s-device-plugin, helm, dapr-fips, grafana-operator, atlantis-fips, istio-fips, docker, podman, harbor-fips, prometheus-elasticsearch-exporter, podman-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kube-state-metrics, mattermost-fips, helm, external-dns, docker-machine-driver-harvester, omnictl-multiarch-fips, gitea, fscrypt, harbor-fips, external-secrets-operator, prometheus-elasticsearch-exporter, chisel-fips, snyk-cli, vitess, mattermost, rancher,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: step-issuer, kube-state-metrics, crossplane-provider-azure-web, crossplane, mattermost-fips, chainloop-cli-fips, crossplane-provider-azure-security, splunk-otel-collector, helm, external-dns, atlantis-fips, crossplane-provider-azure-policyinsights,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: kube-state-metrics, mattermost-fips, chainloop-cli-fips, splunk-otel-collector, helm, external-dns, podman, terragrunt-fips, omnictl-multiarch-fips, gitea, fscrypt, harbor-fips, external-secrets-operator, prometheus-elasticsearch-exporter, grype-db, podman-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: rancher-machine, telegraf, crossplane-provider-aws-sqs, crossplane-provider-azure-authorization, crossplane-provider-aws-ec2, k3s, cert-manager, kubernetes, gptscript, mods, flux-image-automation-controller, argo-cd, crossplane-provider-aws-lambda,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: rancher-machine, telegraf, crossplane-provider-azure-authorization, k3s, cert-manager, kubernetes, gptscript, mods, flux-image-automation-controller, argo-cd, step, datadog-agent, argo-events, flux, steampipe, chezmoi, zot, splunk-otel-collector, podman, external-dns...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: snyk-cli, telegraf, mattermost, gitea, cilium, cert-manager, k3s, kaf, kubernetes, trivy, flux-image-automation-controller, cilium-cli, flux, kubernetes-dashboard, flux-source-controller, gitlab-kas, opentelemetry-collector, zarf, helm, istio, prometheus,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: telegraf, k3s, cert-manager, kubernetes, gptscript, flux-image-automation-controller, argo-cd, step, argo-events, flux, chezmoi, zot, podman, external-dns, trivy-operator, nuclei, kine, rancher, pulumi-language-dotnet, snyk-cli, apko, scorecard, wolfictl, gitlab-kas,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: snyk-cli, gomplate, telegraf, mattermost, apko, gitea, cilium, cert-manager, k3s, kaf, kubernetes, nfpm, gptscript, witness, trivy, flux-image-automation-controller, scorecard, argo-cd, wolfictl, grype, datadog-agent, cilium-cli, argo-events, flux, guac,...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: beats-fips, kube-mgmt, spegel, crossplane, headlamp, neuvector, xeol, ctop, helm, kubescape-operator-fips, helm-exporter-fips, docker, chartmuseum-fips, cluster-api-helm-controller-fips, grype-db, helm-mapkubeapis, harvester-fips, amazon-ecs-agent, rancher, kgateway,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: beats-fips, kube-mgmt, spegel, crossplane, headlamp, neuvector, xeol, ctop, helm, kubescape-operator-fips, helm-exporter-fips, docker, chartmuseum-fips, cluster-api-helm-controller-fips, grype-db, helm-mapkubeapis, harvester-fips, amazon-ecs-agent, rancher, kgateway,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: beats-fips, kube-mgmt, spegel, crossplane, headlamp, neuvector, xeol, ctop, helm, kubescape-operator-fips, helm-exporter-fips, docker, chartmuseum-fips, cluster-api-helm-controller-fips, grype-db, helm-mapkubeapis, harvester-fips, amazon-ecs-agent, rancher, kgateway,...