GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: upwind-agent, commercial-expanso-edge, gitlab-rails-ce, omnictl-multiarch-fips, podman-fips, pulumi-language-yaml, traefik, tekton-pipelines, amazon-ssm-agent, skaffold, terraform, gomplate-fips, grype, tekton-pipelines-fips, aactl, mattermost, dagger,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-opensearch-fips, crossplane-provider-azure-security, amazon-ssm-agent, terraform, steampipe, gomplate-fips, crossplane-provider-aws-ecr, crossplane-provider-aws-rolesanywhere-fips, tekton-pipelines-fips, crossplane-provider-aws-sqs-fips,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: docker, upwind-agent, step, neuvector-sigstore-interface-fips, pulumi-language-dotnet, flux-operator, commercial-expanso-edge, gitlab-rails-ce, omnictl-multiarch-fips, podman-fips, vault, docker-cli-buildx-fips, pulumi-language-yaml, traefik, tekton-pipelines,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: upwind-agent, commercial-expanso-edge, gitlab-rails-ce, omnictl-multiarch-fips, traefik, tekton-pipelines, skaffold, terraform, tekton-pipelines-fips, aactl, mattermost, argo-workflows-fips, vitess, knative-kafka-broker-fips, cilium-cli, drone-fips, helm, etcd-fips,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: telegraf, cilium, trivy-operator, zarf, trivy, flux-image-automation-controller, rancher, k3s, k9s, kubernetes-dashboard, cloud-provider-aws, kaf, osv-scanner, kine, kubescape, nerdctl, skaffold, cilium-cli, helm, mattermost, kots, fscrypt, cert-manager, aactl,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: trivy-operator, flux-kustomize-controller, docker-machine-driver-harvester, rancher, k9s, apko, wolfictl, kine, caddy, vault-benchmark, external-secrets-operator, kots, fscrypt, fulcio, docker-cli-buildx, policy-controller, kyverno, opentelemetry-collector,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: trivy-operator, crossplane-provider-aws-sns, flux-kustomize-controller, rancher, k9s, apko, wolfictl, docker-compose, kine, caddy, vault-benchmark, external-secrets-operator, kots, fscrypt, tw, crossplane-provider-aws-rds, fulcio,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: trivy-operator, crossplane-provider-aws-sns, flux-kustomize-controller, rancher, k9s, apko, wolfictl, docker-compose, kine, caddy, vault-benchmark, external-secrets-operator, kots, fscrypt, tw, crossplane-provider-aws-rds, fulcio,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: telegraf, cilium, rancher, k3s, kubernetes-dashboard, cloud-provider-aws, podman, kaf, kine, nerdctl, cilium-cli, helm, mattermost, kots, fscrypt, cert-manager, aactl, docker-cli-buildx, kyverno, opentelemetry-collector, istio, external-dns, zot, spire-server,...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

EUVD-2026-39794

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

CVE-2026-9640 concerns LXD versions 6.0–6.9, 5.21.0–5.21.5, and 5.0.0–5.0.7. It describes a privilege escalation where an authenticated project operator in a restricted multi-tenant environment can bypass project-restriction policies during snapshot restoration by importing a malicious instance b...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

PT-2026-53022

Name of the Vulnerable Software and Affected Versions Nebula Mesh affected versions not specified Description The web UI /ui/ fails to apply per-operator Certificate Authority CA scoping. This allows any authenticated non-admin operator to access, block, or delete resources belonging to other...

PT-2026-52844

Name of the Vulnerable Software and Affected Versions LXD versions 6.0 through 6.8 LXD versions 5.21.0 through 5.21.4 LXD versions 5.0.0 through 5.0.6 Description An issue exists in the handling of project-restriction policies during snapshot restoration. An authenticated project operator in a...

CVE-2026-47770

A flaw was found in jq, a command-line JSON processor. This vulnerability allows a local user or an attacker providing malicious input to cause a denial of service DoS by comparing two sufficiently deeply nested arrays using the '==' operator. This action exhausts the C stack due to uncontrolled...

GO-2026-5723 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets

External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions...