RHSA-2025:19733 Red Hat Security Advisory: pcs security update

Bulletin has no description...

md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989437)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989437 advisory. In the Linux kernel, the following vulnerability has been resolved: md/bitmap: don't set sb values if can't pass sanity check If bitmap area contains invalid data,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989939)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989939 advisory. In the Linux kernel, the following vulnerability has been resolved: exfat: check if cluster num is valid Syzbot reported slab-out-of-bounds read in exfatclearbitmap...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990097)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990097 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after conversion from inline format Commit 6dbf7bb55598 fs: Don't...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-989927)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989927 advisory. In the Linux kernel, the following vulnerability has been resolved: md/bitmap: don't set sb values if can't pass sanity check If bitmap area contains invalid data,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989030)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989030 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: mount fails with buffer overflow in strlen Starting with kernel 5.11 built with...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988855)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988855 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix race between searching chunks and release journalhead from bufferhead Encountered a ra...

Missing Authentication

Overview Affected versions of this package are vulnerable to Missing Authentication in the xDS interface. An attacker can access sensitive configuration data, including certificate information, backend service details, routing rules, and cluster metadata, by connecting to the exposed port without...

Missing Authentication

Overview Affected versions of this package are vulnerable to Missing Authentication in the xDS interface. An attacker can access sensitive configuration data, including certificate information, backend service details, routing rules, and cluster metadata, by connecting to the exposed port without...

Missing Authentication

Overview Affected versions of this package are vulnerable to Missing Authentication in the xDS interface. An attacker can access sensitive configuration data, including certificate information, backend service details, routing rules, and cluster metadata, by connecting to the exposed port without...

kgateway is missing xDS authorization

Summary The xDS interface in Kgateway versions 2.0.0 through 2.0.4 lacks authentication, allowing any client with unrestricted network access to the xDS port to retrieve potentially sensitive configuration data including certificate data, backend service information, routing rules, and cluster...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command Injection. The vulnerability is due to unsanitized input handling in the cleanTcs mutation due to user-controlled fields being passed to operating-system command execution without proper validation. An attacker can use this to perform...

RHSA-2025:19512 Red Hat Security Advisory: pcs security update

Bulletin has no description...

RHSA-2025:19513 Red Hat Security Advisory: pcs security update

Bulletin has no description...

OS Command Injection

github.com/chaos-mesh/chaos-mesh is vulnerable to OS command injection. The vulnerability is due to improper input validation in the cleanIptables mutation, which allows an unauthenticated in-cluster attacker to execute arbitrary commands and achieve remote code execution across the cluster...

Improper Authentication Exposure

github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: yunikorn-web, dask-gateway, tfsec, rancher-system-agent, sbom-convert, mockgen, cert-exporter, gosu, gobump, ini-file, kafkaexporter, kubernetes-dashboard-metrics-scraper, gops, cri-tools, ko, hivemind, rootlesskit, vertical-pod-autoscaler, cadvisor,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, gobump, hivemind, vertical-pod-autoscaler, custom-pod-autoscaler-operator, hydra, aws-signer-notation-plugin, contour, metacontroller, q, dynamic-localpv-provisioner, ferretdb, kaf, kubernetes-dashboard-web, ghaudit, openbao-k8s,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: yunikorn-web, dask-gateway, tfsec, rancher-system-agent, sbom-convert, mockgen, cert-exporter, gosu, gobump, ini-file, kafkaexporter, kubernetes-dashboard-metrics-scraper, gops, cri-tools, ko, hivemind, rootlesskit, vertical-pod-autoscaler, cadvisor,...