GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: gitness, kgateway, cluster-api-helm-controller-fips, helm-mapkubeapis, linkerd2, steampipe, oras, falcoctl, oras-fips, gogatekeeper, cilium-cli, kgateway-fips, drone-fips, ocm-kubernetes-controller, vcluster, ratify-fips, headlamp-fips, kubescape-operator,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: gitness, kgateway, cluster-api-helm-controller-fips, helm-mapkubeapis, linkerd2, steampipe, oras, falcoctl, oras-fips, gogatekeeper, cilium-cli, kgateway-fips, drone-fips, ocm-kubernetes-controller, vcluster, ratify-fips, headlamp-fips, kubescape-operator,...

GHSA-9C54-X2G4-V92J vulnerabilities

Vulnerabilities for packages: trivy-operator, zarf, trivy, teleport, tekton-chains, kyverno-notation-aws, kubescape, tkn, goreleaser, aactl, gitsign, policy-controller, kyverno, crossplane, ratify, spire-server, neuvector-sigstore-interface, tflint, falcoctl...

CVE-2026-49835 vulnerabilities

Vulnerabilities for packages: trivy-operator, zarf, trivy, teleport, tekton-chains, kyverno-notation-aws, kubescape, tkn, goreleaser, aactl, gitsign, policy-controller, kyverno, crossplane, ratify, spire-server, neuvector-sigstore-interface, tflint, falcoctl...

Critical: Red Hat Security Advisory: Cluster Observability Operator 1.5.0

The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5 release of COO...

GHSA-8X9C-RMQH-456C Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Description This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguarded toString calls. It covers two related coercion points that were not caught by the original patch. Traversable in join and replace filters. SandboxExtension::ensureToStringAllowed...

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Description This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguarded toString calls. It covers two related coercion points that were not caught by the original patch. Traversable in join and replace filters. SandboxExtension::ensureToStringAllowed...

Incorrect Authorization

Overview mythic is an Interact with Mythic C2 Framework Instances Affected versions of this package are vulnerable to Incorrect Authorization due to a broken permission filter in the payloadbuildstep table, which uses an always-satisfied or condition that bypasses operation-scoped access controls...

PYSEC-2026-413 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository | pipeboard-co/meta-ads-mcp | | Affected version | ≤ 1.0.101 commit 496c988 7d14226; Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. | |...

CVE-2026-46604 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, seaweedfs-operator-fips, seaweedfs, rclone, rclone-fips, hugo, listmonk, seaweedfs-operator, mattermost, seaweedfs-fips...

GHSA-QVQC-4C52-X6QP vulnerabilities

Vulnerabilities for packages: kube-arangodb, gpu-operator, gpu-operator-fips, kube-arangodb-fips, guac...

CVE-2026-49349 vulnerabilities

Vulnerabilities for packages: kube-arangodb, gpu-operator, gpu-operator-fips, kube-arangodb-fips, guac...

Authorization Bypass

Apache Camel is vulnerable to Authorization Bypass. The vulnerability is due to insufficient validation of user-controlled Build resources, which allows an authorized attacker to generate Pods in arbitrary Kubernetes namespaces, including the operator namespace...

GHSA-C6V2-3FFM-VCMC Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.3.3. Vulnerability Details CVEID:CVE-2026-45447 DESCRIPTION: Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: upwind-agent, commercial-expanso-edge, gitlab-rails-ce, omnictl-multiarch-fips, traefik, tekton-pipelines, skaffold, terraform, tekton-pipelines-fips, aactl, mattermost, argo-workflows-fips, vitess, knative-kafka-broker-fips, cilium-cli, drone-fips, helm, etcd-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-opensearch-fips, crossplane-provider-azure-security, amazon-ssm-agent, terraform, steampipe, gomplate-fips, crossplane-provider-aws-ecr, crossplane-provider-aws-rolesanywhere-fips, tekton-pipelines-fips, crossplane-provider-aws-sqs-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-opensearch-fips, crossplane-provider-azure-security, amazon-ssm-agent, terraform, steampipe, gomplate-fips, crossplane-provider-aws-ecr, crossplane-provider-aws-rolesanywhere-fips, tekton-pipelines-fips, crossplane-provider-aws-sqs-fips,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: docker, upwind-agent, step, neuvector-sigstore-interface-fips, pulumi-language-dotnet, flux-operator, commercial-expanso-edge, gitlab-rails-ce, omnictl-multiarch-fips, podman-fips, vault, docker-cli-buildx-fips, pulumi-language-yaml, traefik, tekton-pipelines,...