CVE-2026-40564

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

CVE-2026-40564

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

EUVD-2026-31846

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

CVE-2026-40564

The CVE concerns Apache Flink Kubernetes Operator where FlinkSessionJob.jarURI is not validated. In versions 1.3.0 through 1.14.x (up to 1.15.0), a user with CR create permissions can cause the operator pod to fetch arbitrary URLs or access the pod’s filesystem via the jarURI, enabling SSRF and l...

CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

MAL-2026-4782 Malicious code in @catclaw/message-logger-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf070f85ba454a799d80e6998ee717f0fc9084513041893a164752162e0b0864 On plugin registration, the log-collector is enabled by default and uploads session JSONL files from /.openclaw/agents//sessions to...

SUSE CVE-2026-9277

shell-quote's quote function did not validate object-token inputs against the operator model used by parse. The .op field was backslash-escaped character by character using /./g, which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in .op therefore passed...

CVE-2026-45363 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, kube-fluentd-operator, cinc-auditor...

GHSA-C32J-VQHX-RX3X vulnerabilities

Vulnerabilities for packages: kube-logging-operator, kube-fluentd-operator, cinc-auditor...

GHSA-C32J-VQHX-RX3X vulnerabilities

Vulnerabilities for packages: kube-logging-operator, gitlab-rails-ce, gitlab-rails-ce-fips, cinc-auditor, logstash, kube-fluentd-operator...

CVE-2026-45363 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, gitlab-rails-ce, gitlab-rails-ce-fips, cinc-auditor, logstash, kube-fluentd-operator...

PT-2026-43265

Name of the Vulnerable Software and Affected Versions Apache Flink Kubernetes Operator versions 1.3.0 through 1.14.x Description A Server-Side Request Forgery SSRF and local file access issue exists where the jarURI in FlinkSessionJob is not validated. This allows a user with CR create permission...

Apache Flink Kubernetes Operator 安全漏洞

Apache Flink Kubernetes Operator is an operations component for Flink clusters developed by the Apache Foundation. Versions of Apache Flink Kubernetes Operator from 1.3.0 to 1.15.0 contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of the jarURI in...

ZTE ZXUniPOS NDS-LTE 安全漏洞

ZTE ZXUniPOS NDS-LTE is an operator network positioning platform developed by ZTE Corporation. ZTE ZXUniPOS NDS-LTE has a security vulnerability, which stems from business logic defects. Attackers can exploit the features of legitimate applications in an unintended and abnormal manner to carry ou...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: rancher, opa-envoy, wolfictl, headlamp, osv-scanner, ctop, helm-operator, gatekeeper, kots, steampipe, scorecard, tigera-operator, containerd, dagger, kargo, k8ssandra-client, kubescape-operator, helm-set-status, buildkitd, fuse-overlayfs-snapshotter, kube-arangodb,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: rancher, opa-envoy, wolfictl, headlamp, osv-scanner, ctop, helm-operator, gatekeeper, kots, steampipe, scorecard, tigera-operator, containerd, dagger, kargo, k8ssandra-client, kubescape-operator, helm-set-status, buildkitd, fuse-overlayfs-snapshotter, kube-arangodb,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, chainctl-fips, skaffold, chaos-mesh, steampipe, cluster-api-helm-controller, k9s-fips, trivy-operator-fips, cloudbeat-fips, xeol, spegel-fips, kubescape-server, skaffold-fips, helm-operator, tw, gogatekeeper, gatekeeper,...

CVE-2026-9277

shell-quote's quote function did not validate object-token inputs against the operator model used by parse. The .op field was backslash-escaped character by character using /./g, which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in .op therefore passed...