Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

Impact Having the Topic and User operators to watch different namespaces than the one where the Kafka cluster is deployed, is a fully documented feature. When the watchedNamespace field is used within the Topic or User operator as part of the Kafka.spec.entityOperator field, the Cluster Operator...

GHSA-Q99W-VH6V-Q3V7 OpenClaw: Pairing-scoped device session could restore revoked node token authority

Summary In affected releases, a surviving pairing-scoped session for a device could re-establish node token authority after that node token had been revoked. Revocation should require the device to lose that authority unless it is approved again through the normal pairing flow. This issue affects...

SUSE-SU-2026:22241-1 Security update for libarchive

This update for libarchive fixes the following issues - CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches bsc1253088. - CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS bsc1259635. - CVE-2026-4424:...

GHSA-6V84-V468-3C7F Duplicate Advisory: Picklescan has Incomplete List of Disallowed Inputs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-84r2-jw7c-4r5q. This link is maintained to preserve external references. Original Description picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller...

CVE-2025-71320

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when...

Important: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-1 Update

Custom Metrics Autoscaler Operator for Red Hat OpenShift updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...

EUVD-2025-210267

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when...

CVE-2025-71320

The CVE identifies a vulnerability in picklescan prior to 0.0.33, where an incomplete deny-list fails to block pydoc.locate and operator.methodcaller. This allows remote attackers to craft malicious pickle files that, when deserialized, yield arbitrary code execution. The issue is tied to deseria...

CVE-2025-71320 picklescan - Remote Code Execution via Incomplete Disallowed Inputs

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when...

Important: Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update

An updated OpenShift Compliance Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift Compliance Operator v1.9.1 is now available. See the documentation for bug fix information:...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2

The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.21.2 release of Red Hat OpenShift Pipelines Operator...

GHSA-58WC-8WRV-XP9J Duplicate Advisory: Active Memory write scope could mutate global config

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x629-46cc-7xgw. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows...

Duplicate Advisory: Exported session HTML could keep unsafe markdown links

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...

GHSA-6XCG-6Q43-RJ2V Duplicate Advisory: Exported session HTML could keep unsafe markdown links

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...

GHSA-M6FH-WVW4-4629 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, seaweedfs-fips, gitlab-workhorse-ce, seaweedfs, seaweedfs-operator, seaweedfs-operator-fips, mattermost-fips, seaweedfs-rocksdb...

CVE-2026-42500 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, seaweedfs-fips, gitlab-workhorse-ce, seaweedfs, seaweedfs-operator, seaweedfs-operator-fips, mattermost-fips, seaweedfs-rocksdb...

CVE-2026-46599 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, seaweedfs-fips, gitlab-workhorse-ce, seaweedfs, seaweedfs-operator, seaweedfs-operator-fips, mattermost-fips, seaweedfs-rocksdb...

CVE-2026-50010 vulnerabilities

Vulnerabilities for packages: opensearch, kafka, request-9047-keycloak-fips, apache-pulsar, spark-kubernetes-operator-fips, sonarqube, druid, docker-selenium, commercial-elasticsearch, cassandra, logstash, kserve-modelmesh, logstash-fips, elasticsearch, ghidra, celeborn,...

GHSA-C653-97M9-RCG9 vulnerabilities

Vulnerabilities for packages: opensearch, kafka, request-9047-keycloak-fips, apache-pulsar, spark-kubernetes-operator-fips, sonarqube, druid, docker-selenium, commercial-elasticsearch, cassandra, logstash, kserve-modelmesh, logstash-fips, elasticsearch, ghidra, celeborn,...

CVE-2026-53841

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link...