crossplane has 6 CVEs on record between 2023 and 2026. 2 were published in the last 90 days. The median CVSS is 9.0 (critical), with 2 rated critical. None have a confirmed exploitation report. Most affected products: github.com/crossplane/crossplane (3), github.com/crossplane/crossplane-runtime/v2 (2), github.com/crossplane/crossplane/v2 (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.0
- Publish → KEV
- —
- Last 90 days
- 2 prev 1
Products
- github.com/crossplane/crossplane 3
- github.com/crossplane/crossplane-runtime/v2 2
- github.com/crossplane/crossplane/v2 1
Worst active — by depth score
GHSA-7h65-4p22-39j6Critical· 9.8github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses54GHSA-wfqx-gjrf-g28rCritical· 9.0Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag50GHSA-mf7q-r4rv-jv94HighCrossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…41CVE-2023-37900Low· 3.4Denial of service from large image19GO-2026-6302NoneSignature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v23
crossplane vulnerabilities
CVEs affecting crossplane, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
GO-2026-6302NoneSignature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
GHSA-mf7q-r4rv-jv94HighCrossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
GHSA-wfqx-gjrf-g28rCritical· 9.0Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
GO-2024-3219Nonegithub.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
GHSA-7h65-4p22-39j6Critical· 9.8github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2023-37900Low· 3.4Denial of service from large image
Denial of service from large image