CVE-2026-87065

A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to...

CVE-2026-87064

A flaw was found in konflux-operator-tasks. The GitHub workflows used by this component do not explicitly define their required permissions. This oversight means the workflows may inherit default access tokens that grant broader privileges than intended. Such excessive permissions could potential...

CVE-2026-87063

A flaw was found in konflux-operator-tasks. The Continuous Integration CI process installs the tkn command-line interface CLI from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to...

CVE-2026-87061

A flaw was found in olm-operator-konflux-sample. The bundle-hack/updatebundle.sh script lacks mechanisms to stop execution immediately upon encountering an error. This oversight allows critical data processing steps, such as those involving skopeo or jq commands, to fail silently and proceed with...

CVE-2026-87059

A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process...

CVE-2026-87060

A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entire...

CVE-2026-87058

A flaw was found in olm-operator-konflux-sample. The hermetic build mode is disabled by default, allowing bundle builds to perform live network fetches. This means that external, unverified resources can be pulled during the build process, potentially compromising the integrity and trustworthines...

CVE-2026-87062

A flaw was found in konflux-operator-tasks. GitHub Actions within this component are configured to use mutable tags or branches instead of specific, immutable commit SHAs. This vulnerability could allow a remote attacker to introduce malicious code into the build process if they compromise the...

CVE-2026-87057

A flaw was found in olm-operator-konflux-sample. The build pipelines use mutable floating tags to reference runtime base images instead of immutable SHA256 digests. This configuration allows for the content of the base images to be altered without detection, potentially leading to the introductio...

Oracle Linux 8 : ELSA-2026-63124-0: / grafana-pcp (ELSA-2026-631240)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-631240 advisory. 5.1.1-18 - Rebuild against updated golang - Resolves RHEL-241670 - Resolves RHEL-242385 - Resolves RHEL-242345 - Resolves RHEL-242223 5.1.1-17 -...

Oracle Linux 10 : ELSA-2026-63119-0: / grafana-pcp (ELSA-2026-631190)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-631190 advisory. 5.3.0-8.1 - Rebuilt for updated golang - Resolves RHEL-241480, RHEL-251115, RHEL-242257, RHEL-242154, RHEL-241751 5.3.0-8 - Resolves RHEL-188287:...

grafana-pcp security update

5.3.0-8.1 - Rebuilt for updated golang - Resolves RHEL-241480, RHEL-251115, RHEL-242257, RHEL-242154, RHEL-241751 5.3.0-8 - Resolves RHEL-188287: Remove Lua ExclusiveArch macro for Konflux build...

RLSA-2026:46391 Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / rhel-8.10.z Remo...

grafana security, bug fix, and enhancement update

An update is available for grafana. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...

Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / almalinux-8.10.z...

ALSA-2026:46391 Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / almalinux-8.10.z...

mysql8.4 security update

8.4.8-1 - Rebase to 8.4.8 8.4.7-2 - Skip tests that are failing on Konflux - Resolves: ROK-831...

Oracle Linux 10 : mysql8.4 (ELSA-2026-4162)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4162 advisory. 8.4.8-1 - Rebase to 8.4.8 8.4.7-2 - Skip tests that are failing on Konflux - Resolves: ROK-831 Tenable has extracted the preceding description block...