GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: k8s-agents-operator, kubeflow-pipelines, chainloop-control-plane, kubernetes-csi-external-attacher-fips, tkn, chainloop-control-plane-fips, openbao-fips, flux-kustomize-controller-fips, perses, karpenter-fips, seaweedfs-operator, elastic-agent,...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator, cinc-auditor...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator, cinc-auditor...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

renovate-operator v5.4.0

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: cinc-auditor, gitlab-rails-ce, commercial-gitlab-rails-ee, kube-logging-operator, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: cinc-auditor, logstash, pghero-fips, ruby3.2-fluentd-kubernetes-daemonset, pact-broker-docker, gitlab-rails-ce, pghero, commercial-gitlab-rails-ee, kube-logging-operator, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: cinc-auditor, gitlab-rails-ce, commercial-gitlab-rails-ee, kube-logging-operator, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: cinc-auditor, logstash, pghero-fips, ruby3.2-fluentd-kubernetes-daemonset, pact-broker-docker, gitlab-rails-ce, pghero, commercial-gitlab-rails-ee, kube-logging-operator, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

EUVD-2026-48612

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006

lakeFS

CVE-2026-66006: Missing Authentication for Critical Function

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...