ROS-20260429-73-0040

A vulnerability in the incoming traffic controller in the Kubernetes ingress-nginx cluster is related to flaws in the input validation mechanism. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.3 security update

The multicluster engine for Kubernetes 2.9 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.9 images The multicluster engine for Kubernetes provides the foundational components that are...

Important: Red Hat Security Advisory: VolSync v0.14 security fixes and container updates

VolSync v0.14 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2026-40891 vulnerabilities

Vulnerabilities for packages: kubernetes-reflector...

GHSA-G94R-2VXG-569J vulnerabilities

Vulnerabilities for packages: promitor, kubernetes-reflector...

CVE-2026-40894 vulnerabilities

Vulnerabilities for packages: promitor, kubernetes-reflector...

GHSA-MR8R-92FQ-PJ8P vulnerabilities

Vulnerabilities for packages: kubernetes-reflector...

CVE-2026-40891 vulnerabilities

Vulnerabilities for packages: kubernetes-reflector, azure-functions-host...

CVE-2026-40894 vulnerabilities

Vulnerabilities for packages: kubernetes-reflector, promitor, azure-functions-host...

GHSA-G94R-2VXG-569J vulnerabilities

Vulnerabilities for packages: kubernetes-reflector, promitor, azure-functions-host...

GHSA-MR8R-92FQ-PJ8P vulnerabilities

Vulnerabilities for packages: kubernetes-reflector, azure-functions-host...

CVE-2026-35469 affecting package kubernetes for versions less than 1.30.10-23

CVE-2026-35469 affecting package kubernetes for versions less than 1.30.10-23. A patched version of the package is available...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, nerdctl-fips, tetragon-fips, cadence-fips, argo-events-fips, step-fips, trident-fips, kubernetes-csi-node-driver-registrar, net-kourier-fips, crossplane-provider-aws-emr-fips, aws-privateca-issuer, eksctl, image-factory-fips, neuvector-fips,...

GHSA-X4MJ-7F9G-29H4 vulnerabilities

Vulnerabilities for packages: external-dns, k8sgateway...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: slsa-verifier, nerdctl, act, cri-tools, rancher-machine, datadog-agent, promxy, trivy, external-dns, chartmuseum, node-problem-detector, flux, crossplane-provider-aws-kinesis, flux-helm-controller, kubernetes-event-exporter, crossplane-provider-aws-elasticache,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: slsa-verifier, nerdctl, act, cri-tools, rancher-machine, datadog-agent, promxy, trivy, external-dns, chartmuseum, node-problem-detector, flux, crossplane-provider-aws-kinesis, flux-helm-controller, kubernetes-event-exporter, crossplane-provider-aws-elasticache,...

[SECURITY] Fedora 44 Update: trivy-0.69.3-1.fc44

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more...

SUSE SLES15 Security Update : tomcat (SUSE-SU-2026:1604-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1604-1 advisory. Security fixes: - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open...

GHSA-XHJW-95FP-8VGQ Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Summary There is a vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the createChainMiddleware function. Even when providers.kubernetesCRD.allowCrossNamespace=false is set, references in spec.chain.middlewares may be followed to access objects in other namespaces. A user with...