CVE-2025-64529

SpiceDB prior to v1.45.2 is affected when the exclusion operator is used and a per-call payload is large due to --write-relationships-max-updates-per-call > 6500. In this scenario, WriteRelationships can return success for a failed operation and produce incorrect permission results if the affe...

CVE-2025-64529 SpiceDB's WriteRelationships fails silently if payload is too big

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that...

CVE-2025-64529 SpiceDB's WriteRelationships fails silently if payload is too big

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that...

SpiceDB 安全漏洞

SpiceDB is a fine-grained permissions database from the Authzed team. A security vulnerability exists in SpiceDB versions prior to 1.45.2, which stems from a write relation call not being handled correctly when using the exclude operator, which could lead to incorrect permission check results...

FBI Wants to Know Who Runs Archive.ph

The FBI has issued a federal subpoena to domain registrar Tucows, demanding extensive billing and session records to unmask the anonymous operator of Archive.ph Archive.is and Archive.today. The site, known for bypassing paywalls, is now the subject of an undisclosed criminal investigation...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.17 Images Update

New images are available for Red Hat build of Keycloak 26.0.17 and Red Hat build of Keycloak 26.0.17 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

CVE-2025-64171

A cross-namespace authorization flaw has been identified in the MARIN3R operator’s DiscoveryServiceCertificate resource. The flaw occurs because the operator mistakenly treats certain inputs as valid, bypassing Kubernetes Role-Based Access Control RBAC. When a user has permission to create...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: terraform-provider-tls, kube-vip-cloud-provider, mkcert, terraform-provider-azuread, dockerize, opensearch-k8s-operator, wave, kafka-proxy, incert, pulumi-kubernetes-operator, grpcurl, oras, task, spark-operator, wireguard-go, govulncheck, kind, aws-s3-controller,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: terraform-provider-tls, kube-vip-cloud-provider, mkcert, terraform-provider-azuread, dockerize, opensearch-k8s-operator, wave, kafka-proxy, mesosphere-vsphere-csi, incert, pulumi-kubernetes-operator, grpcurl, oras, task, spark-operator, wireguard-go, govulncheck, kin...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: terraform-provider-tls, kube-vip-cloud-provider, mkcert, terraform-provider-azuread, dockerize, opensearch-k8s-operator, wave, kafka-proxy, mesosphere-vsphere-csi, incert, pulumi-kubernetes-operator, grpcurl, oras, task, spark-operator, wireguard-go, govulncheck, kin...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: terraform-provider-tls, kube-vip-cloud-provider, terraform-provider-azuread, dockerize, opensearch-k8s-operator, wave, kafka-proxy, mesosphere-vsphere-csi, incert, pulumi-kubernetes-operator, grpcurl, oras, task, spark-operator, wireguard-go, govulncheck, kind,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: terraform-provider-tls, kube-vip-cloud-provider, mkcert, terraform-provider-azuread, dockerize, opensearch-k8s-operator, wave, kafka-proxy, mesosphere-vsphere-csi, incert, pulumi-kubernetes-operator, grpcurl, oras, task, spark-operator, wireguard-go, govulncheck, kin...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: terraform-provider-tls, kube-vip-cloud-provider, mkcert, terraform-provider-azuread, dockerize, opensearch-k8s-operator, wave, kafka-proxy, mesosphere-vsphere-csi, incert, pulumi-kubernetes-operator, grpcurl, oras, task, spark-operator, wireguard-go, govulncheck, kin...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, litefs, local-static-provisioner-fips, rootlesskit-fips, syncthing, cluster-api-provider-vsphere, kuberay-operator-fips, kind, speedtest-go, k6-fips, runc, crossplane, harbor-scanner-trivy-fips, kube-metrics-adapter-fips,...

ROS-20251030-02

A vulnerability in the NVIDIA Virtual GPU Manager component of the NVIDIA Virtual GPU driver Virtual GPU is associated with incorrectly assigning permissions to a critical resource. Exploitation of the vulnerability could allow an attacker to cause a denial of service Vulnerability in the NVIDIA...

GHSA-Q8J9-34QF-7VQ7 Silver has unrestricted traffic between Wireguard clients

Summary Sliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to: 1. Leaked/recovered keypair from a beacon being used to attack operators. 2. Port forwardings usable from other implants. Details 1. Sliver treat operators' Wireguard config and...

ROS-20251028-10

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...