PT-2026-53085

Name of the Vulnerable Software and Affected Versions Gitea act runner versions prior to 0.262.0 Description When using the Docker backend, the software passes the container.options string from a workflow to the Docker job container's HostConfig. If privileged is set to false, the system only...

CVE-2026-53576

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576

Kestra (OSS) before versions 1.0.45 and 1.3.21 is affected by an authentication bypass in the REST API filter. The code checks request.getPath().endsWith("/configs") instead of matching the exact endpoint, causing anonymous bypass to endpoints like /api/v1/{tenant}/flows/configs and /api/v1/{tena...

EUVD-2026-39919

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: crossplane, tflint, neuvector-sigstore-interface, cloudbeat, ratify, kyverno-notation-aws-fips, trivy-operator, crossplane-fips, kubescape-server, kubescape-server-fips, tbot, policy-controller, ratify-fips, zarf-fips, commercial-kyverno, teleport, gitsign, gorelease...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: crossplane, tflint, neuvector-sigstore-interface, cloudbeat, ratify, kyverno-notation-aws-fips, trivy-operator, crossplane-fips, kubescape-server, kubescape-server-fips, tbot, policy-controller, ratify-fips, zarf-fips, commercial-kyverno, teleport, gitsign, gorelease...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: gatus, kine, gitea-fips, grype-fips, flux-image-automation-controller, longhorn-manager, prometheus-operator, docker-machine-driver-harvester, mattermost-fips, docker-cli-buildx, external-secrets-operator, splunk-otel-collector-fips, nemo, apko-fips, harbor-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kine, gitea-fips, flux-image-automation-controller, prometheus-operator, docker-machine-driver-harvester, mattermost-fips, external-secrets-operator, nemo, harbor-fips, kubescape-server-fips, knative-kafka-broker, terraform, external-secrets-operator-fips, vault-fips...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb-fips, gitea-fips, crossplane-provider-aws-directconnect, prometheus-operator, mattermost-fips, docker-cli-buildx, external-secrets-operator, atlantis-fips, crossplane-provider-aws-cloudwatch, longhorn-cli-fips, gatus-fips, vault-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb-fips, gitea-fips, crossplane-provider-aws-directconnect, prometheus-operator, mattermost-fips, docker-cli-buildx, external-secrets-operator, atlantis-fips, crossplane-provider-aws-cloudwatch, longhorn-cli-fips, gatus-fips, vault-fips,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: kine, prometheus-operator, mattermost-fips, docker-cli-buildx, external-secrets-operator, nemo, harbor-fips, knative-kafka-broker, terraform, external-secrets-operator-fips, vault-fips, tekton-pipelines, zot, external-dns, elastic-agent-fips, gitlab-rails-ce-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gatus, kine, neuvector-sigstore-interface, flux-image-automation-controller, prometheus-operator, docker-machine-driver-harvester, docker-cli-buildx, eksctl, ksops, external-secrets-operator, kargo, dagger, gitlab-runner, teleport, flux-kustomize-controller, zot, tkn...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: gatus, kine, flux-image-automation-controller, prometheus-operator, docker-machine-driver-harvester, docker-cli-buildx, external-secrets-operator, dagger, gitlab-runner, zot, external-dns, zarf, kubernetes-dashboard, aactl, k9s, argocd-image-updater,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: gatus, kine, neuvector-sigstore-interface, flux-image-automation-controller, prometheus-operator, docker-machine-driver-harvester, docker-cli-buildx, eksctl, ksops, external-secrets-operator, kargo, dagger, gitlab-runner, teleport, flux-kustomize-controller, zot, tkn...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, kine, buildah, mattermost, cloud-provider-aws, rancher-agent, gitlab-kas, prometheus-operator, fscrypt, falco-no-driver, nerdctl, docker-cli-buildx, prometheus, cilium-cli, rancher, telegraf, kaf, flux, spire-server, kubernetes, cilium, zot,...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...