CVE-2026-76827 Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

CVE-2026-76827

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

CVE-2026-54689

creationtimestamp| type| source ---|---|--- 2026-08-19 20:35:08+00:00| published-proof-of-concept| https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-wppf-h75h-6pm6...

CVE-2026-70496

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-70496 Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-70496 Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

EUVD-2026-62678

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-70496

The search-v2-operator ClusterRole grants cluster-admin-equivalent privileges (impersonation, RBAC write, CSR approval, ManifestWork management), enabling privilege escalation. No exploitation details or patch versions are provided in the documents; monitor Red Hat advisories for remediation guid...

CVE-2026-70496

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-71470

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-71470 Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-71470 Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

EUVD-2026-62590

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-71470

In ACM search-v2-operator, CR editor fields (imageOverride, arguments, env vars) are unsanitized into pods running under an impersonation ServiceAccount, enabling arbitrary secret mounting or container image replacement for privilege escalation and full cluster compromise. Red Hat advises restric...

CVE-2026-71470

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

Arbitrary Argument Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Arbitrary Argument Injection via the escapeLikeWildcards process. An attacker can cause excessive resource consumption and degrade service availability ...

CVE-2026-75954

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause...

Malicious Package

Overview bnpl-blocks-independent-bnpl-search is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

CVE-2026-75954 Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause...

CVE-2026-75954

J-BusinessDirectory (a Joomla extension by cmsjunkie.com) is vulnerable to SQL injection in its trips search feature. The root cause is the direct concatenation of user-supplied search keywords and the ORDER BY clause into SQL queries without sanitization. The vulnerability is exploitable over th...