CVE-2026-54495 Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

EUVD-2026-82405

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

CVE-2026-54495 Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

DEBIAN-CVE-2026-90322

In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nmnodelocalstore handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode return 255,...

CVE-2026-90200

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

DEBIAN-CVE-2026-90200

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

CVE-2026-90322 ocfs2/cluster: keep heartbeat local node stable

In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nmnodelocalstore handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode return 255,...

CVE-2026-90322

CVE-2026-90322 affects the Linux kernel OCFS2 cluster subsystem (nodemanager and disk heartbeat). The root cause is that when the local node is reset via local=0, the cl_has_local flag is left set while cl_local_node is set to the invalid value 255. Heartbeat threads that dynamically re-read o2nm...

EUVD-2026-81983

In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nmnodelocalstore handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode return 255,...

CVE-2026-90200 fs/ntfs3: fix integer overflow in MFT cluster validation

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

EUVD-2026-81793

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

CVE-2026-90200

CVE-2026-90200 affects the Linux kernel NTFS3 filesystem driver (fs/ntfs3). In ntfs_init_from_boot(), the MFT cluster numbers (mlcn, mlcn2) read from the boot sector are validated via a u64 multiplication against the volume size. A sufficiently large value (e.g., near 2^62) causes the multiplicat...

tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

tomcat: Apache Tomcat: Replay attack via improper authentication in EncryptionInterceptor

A flaw was found in Apache Tomcat. An improper authentication vulnerability in the EncryptionInterceptor component allows a remote attacker to perform a replay attack. This could lead to unauthorized access or manipulation of data within the cluster component...

Important: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.17 update

The Migration Toolkit for Containers MTC 1.8.17 is now available. The Migration Toolkit for Containers MTC enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes...

CVE-2026-92925

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...