CLEANSTART-2026-QI90911 Security fixes in thanos-operator-fips 0.3.7-r0

Package thanos-operator-fips version 0.3.7-r0 fixes 2 vulnerabilities: CVE-2025-61729, CVE-2025-61727...

CLEANSTART-2026-XF79120 Security fixes in minio-operator-fips 5.0.18-r7

Package minio-operator-fips version 5.0.18-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-SE55745 Security fixes in k8ssandra-operator-fips 1.29.0-r0

Package k8ssandra-operator-fips version 1.29.0-r0 fixes 2 vulnerabilities: CVE-2025-61729, CVE-2025-61727...

CLEANSTART-2026-XI30984 Security fixes in zookeeper-operator 0.2.15-r1

Package zookeeper-operator version 0.2.15-r1 fixes 3 vulnerabilities: CVE-2023-44487, CVE-2023-39325, CVE-2024-24786...

CVE-2026-44097

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

EUVD-2026-51032

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CVE-2026-44097 File Upload vulnerability

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CVE-2026-44097

The CVE-2026-44097 entry describes a low-privileged remote attacker with operator access who can upload arbitrary files through the firmware-update REST endpoint, leading to persistent attacker-controlled data and potential DoS via resource exhaustion. The root cause is an unrestricted file uploa...

CVE-2026-15240

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240

The Customer Switching WordPress plugin (versions before 2.1.3 ) contains a privilege escalation vulnerability due to insecure session binding. The plugin fails to securely link an active user-switching session to the operator who initiated it. This flaw allows a lower-privileged account—that an ...

EUVD-2026-50996

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240 Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

PT-2026-85988

Package eck-operator version 3.2.0-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

PT-2026-85938

Package tigera-operator-fips version 1.37.2-r0 fixes 2 vulnerabilities: ghsa-6v2p-p543-phr9, ghsa-mf24-chxh-hmvj...

PT-2026-66395

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

PT-2026-85867

Package prometheus-operator-fips version 0.87.0-r1 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

PT-2026-86078

Package minio-operator-fips version 5.0.18-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

PT-2026-86003

Package minio-operator-fips version 7.0.1-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

PT-2026-85913

Package victoriametrics-operator-fips version 0.65.0-r0 fixes 1 vulnerabilities: ghsa-66jq-2c23-2xh5...

PT-2026-66425

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...