CVE-2026-104055: Insertion of Sensitive Information into Log File

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

PT-2026-104440

Name of the Vulnerable Software and Affected Versions postgresql-operator charm versions prior to 1189 arm64 and 1190 amd64 in the dev track 14/edge postgresql-operator charm versions prior to 1216 arm64 and 1217 amd64 in the stable track 14/stable Description The postgresql-operator charm utiliz...

PT-2026-104448

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

GHSA-8988-9CW3-XX77 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1, awx, openstack-kolla-toolbox-2025.2, openstack-barbican-2025.2, superset, openstack-horizon-2025.1-fips, spamcheck, nemo, openstack-placement-2025.1-fips, openstack-cinder-2026.1, openstack-kolla-toolbox-2025.2-fips,...

CVE-2026-97689 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1, awx, openstack-kolla-toolbox-2025.2, openstack-barbican-2025.2, superset, openstack-horizon-2025.1-fips, spamcheck, nemo, openstack-placement-2025.1-fips, openstack-cinder-2026.1, openstack-kolla-toolbox-2025.2-fips,...

GHSA-GH4C-6FX4-QH6G vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1, awx, openstack-kolla-toolbox-2025.2, openstack-barbican-2025.2, superset, openstack-horizon-2025.1-fips, spamcheck, nemo, openstack-placement-2025.1-fips, openstack-cinder-2026.1, openstack-kolla-toolbox-2025.2-fips,...

GHSA-VXQ7-64XX-V4GW vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1, awx, openstack-kolla-toolbox-2025.2, openstack-barbican-2025.2, superset, openstack-horizon-2025.1-fips, spamcheck, nemo, openstack-placement-2025.1-fips, openstack-cinder-2026.1, openstack-kolla-toolbox-2025.2-fips,...

backup_dc_registry

Copia de seguridad del registro de Backup Operator para comprometer el dominio Un POC simple que abusa de los privilegios de Backup Operator para volcar de forma remota las hives SAM, SYSTEM y SECURITY. Créditos de la investigación: @filipdragovic Portado del PoC de Windows de @mpgn Uso Esta prue...

CVE-2026-55396

The Teledyne FLIR Aware2 software, specifically in versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) , is vulnerable to the cleartext transmission of UDP traffic from the operator control unit to the robot. Because this traffic lacks a cryptographic integrity check , adjacent unauthenticat...

Fortigate-SSL-VPN-Exploit-Kit

Kit de FortiGate SSL-VPN recuperado en la naturaleza Archivo de investigación. Recuperado tal como se encontró. Yo no escribí estos archivos. Publicado: 1 de septiembre de 2026 Este repositorio es el orquestador, los payloads de segunda etapa y los listeners de operador que se sitúan sobre un...

Important: Red Hat Security Advisory: Cluster Observability Operator 1.5.3

The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5.3 release of COO...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 Escalada de privilegios local en FreeBSD medianteexecargsadjustargs con memmove fuera de límites Un error de precedencia de operadores en execargsadjustargs sys/kern/kernexec.c, presente desde 2013...

trivy-enforcer

trivy-enforcer EXPERIMENTAL Operador de Kubernetes para el aseguramiento de imágenes Funciona como Controlador de admisión Evita que se desplieguen imágenes inseguras Controlador personalizado Observa el CRD ImageVulnerability y escanea la imagen en el recurso personalizado automáticamente...

CVE-2024-53900

Desafío CTF - Mongoose RCE CVE-2024-53900 Resumen del Desafío Este desafío de Captura la Bandera CTF está basado en CVE-2024-53900, una vulnerabilidad en Mongoose que permite la Ejecución Remota de Código RCE debido al uso incorrecto del operador $where en consultas MongoDB. ¡Tu objetivo es...

CVE-2018-16509

CVE-2018-16509 Campo de pruebas Docker "Se descubrió un problema en Artifex Ghostscript anterior a la versión 9.24. La comprobación incorrecta de la «restauración de privilegios» durante el manejo de excepciones /invalidaccess podría ser utilizada por atacantes capaces de proporcionar PostScript...

BIT-PARSE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

ruby:2.5 security update

An update is available for rubygem-mysql2, module.rubygem-mysql2, module.rubygem-bundler, module.ruby, module.rubygem-mongo, module.rubygem-pg, module.rubygem-bson, ruby, rubygem-bundler, rubygem-abrt, rubygem-pg, rubygem-mongo, module.rubygem-abrt, rubygem-bson. This update affects Rocky Linux 8...

Homomorphic Advantage Operator: Stabilizing Reinforcement Learning under Fully Homomorphic Encryption Constraints

Privacy-preserving machine learning presents significant deployment challenges on the cloud for intelligent systems with confidential data. Fully Homomorphic Encryption FHE offers a compelling solution for secure computation, preserving data confidentiality of cloud computations. However, applyin...

PT-2026-104015

Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.3 PackBot Teledyne FLIR Aware2 versions prior to 1.7.10 FirstLook Description UDP traffic between the operator control unit and the robot is transmitted in cleartext without a cryptographic integrit...

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...