CVE-2026-89407 vulnerabilities

Vulnerabilities for packages: wildfly, wavefront-proxy, opensearch, jenkins-plugin-manager, strimzi-kafka-oauth, sonarqube, druid, keycloak-config-cli, tez, logstash, management-api-for-apache-cassandra-5.0, neo4j, celeborn, strimzi-kafka-operator, spark, akhq, thingsboard, cass-config-builder,...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: wildfly, wavefront-proxy, opensearch, jenkins-plugin-manager, strimzi-kafka-oauth, sonarqube, druid, keycloak-config-cli, tez, logstash, management-api-for-apache-cassandra-5.0, neo4j, celeborn, strimzi-kafka-operator, spark, akhq, thingsboard, cass-config-builder,...

GO-2026-6596 vulnerabilities

Vulnerabilities for packages: kubescape-operator, cilium, kubescape, hubble, hubble-ui...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: k8sgpt, k9s, cert-manager-cmctl, flux-helm-controller, gitness, helm-push, kargo, kube-arangodb, xeol, kyverno-notation-aws, manifest-tool, helm-set-status, maru, tigera-operator, rancher-helm, opentofu, helm-mapkubeapis, cluster-api-helm-controller...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: k8sgpt, k9s, cert-manager-cmctl, flux-helm-controller, gitness, helm-push, kargo, kube-arangodb, xeol, kyverno-notation-aws, manifest-tool, helm-set-status, maru, tigera-operator, rancher-helm, opentofu, helm-mapkubeapis, cluster-api-helm-controller...

GO-2026-6597 vulnerabilities

Vulnerabilities for packages: trivy-operator, dagger, docker-cli-buildx, kubevela, steampipe, buildkitd, falco-no-driver, cluster-api-helm-controller, fuse-overlayfs-snapshotter, scorecard, xeol, chartmuseum, eksctl, neuvector-scanner, syft, kubescape-operator, docker, tigera-operator, nerdctl,...

EUVD-2026-91803

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

CVE-2026-104055

The postgresql-operator charm contains a vulnerability where the Prometheus postgres_exporter writes the monitoring user's password in cleartext to its logs during database connection errors. An attacker with log-reading permissions can recover this password to gain read-only pg_monitor access to...

CVE-2026-104055 Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

CVE-2026-104055 Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

CVE-2026-104055: Insertion of Sensitive Information into Log File

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

PT-2026-104440

Name of the Vulnerable Software and Affected Versions postgresql-operator charm versions prior to 1189 arm64 and 1190 amd64 in the dev track 14/edge postgresql-operator charm versions prior to 1216 arm64 and 1217 amd64 in the stable track 14/stable Description The postgresql-operator charm utiliz...

PT-2026-104448

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

GHSA-8988-9CW3-XX77 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, presidio-analyzer, jupyterhub-k8s-singleuser-sample, pypy-3.10, airflow-postgres-fips, openstack-client-2026.1, jwt-tool, nemo, openstack-placement-2025.2-fips, openstack-placement-2025.1, request-1276, openstack-nova-2026.1,...

GHSA-VXQ7-64XX-V4GW vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, presidio-analyzer, jupyterhub-k8s-singleuser-sample, pypy-3.10, airflow-postgres-fips, openstack-client-2026.1, jwt-tool, nemo, openstack-placement-2025.2-fips, openstack-placement-2025.1, request-1276, openstack-nova-2026.1,...

GHSA-GH4C-6FX4-QH6G vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, presidio-analyzer, jupyterhub-k8s-singleuser-sample, pypy-3.10, airflow-postgres-fips, openstack-client-2026.1, jwt-tool, nemo, openstack-placement-2025.2-fips, openstack-placement-2025.1, request-1276, openstack-nova-2026.1,...

CVE-2026-97689 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1-fips, presidio-analyzer, jupyterhub-k8s-singleuser-sample, pypy-3.10, airflow-postgres-fips, openstack-client-2026.1, jwt-tool, nemo, openstack-placement-2025.2-fips, openstack-placement-2025.1, request-1276, openstack-nova-2026.1,...

GO-2026-6590 OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator

OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

CVE-2026-55396

The Teledyne FLIR Aware2 software, specifically in versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) , is vulnerable to the cleartext transmission of UDP traffic from the operator control unit to the robot. Because this traffic lacks a cryptographic integrity check , adjacent unauthenticat...

Important: Red Hat Security Advisory: Cluster Observability Operator 1.5.3

The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5.3 release of COO...