SUSE SLES12 Security Update : cifs-utils (SUSE-SU-2026:2700-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2700-1 advisory. This update for cifs-utils fixes the following issue - CVE-2026-12505: cifs.upcall local privilege escalation via requestkey-controlled namespace switc...

SUSE SLED15 / SLES15 Security Update : cifs-utils (SUSE-SU-2026:2699-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2699-1 advisory. This update for cifs-utils fixes the following issue - CVE-2026-12505: cifs.upcall local privilege escalation via...

GHSA-VX8H-4PRV-G744 Rancher has Privilege Escalation from Project Owner to Host

Impact A vulnerability has been identified in Rancher Manager that allows users assigned the Project Owner role to modify Pod Security Admission PSA labels on namespaces within their projects. Under the default role configuration, an attacker with the following access pattern can exploit this...

Rancher has Privilege Escalation from Project Owner to Host

Impact A vulnerability has been identified in Rancher Manager that allows users assigned the Project Owner role to modify Pod Security Admission PSA labels on namespaces within their projects. Under the default role configuration, an attacker with the following access pattern can exploit this...

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share the same downstream clusters e.g., different privileged or untrusted teams inside the same organization. On unpatched versions, tenants could bypass restrictions to access any conf...

GHSA-XR65-5CPM-G36X Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share the same downstream clusters e.g., different privileged or untrusted teams inside the same organization. On unpatched versions, tenants could bypass restrictions to access any conf...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the valuesFrom process. An attacker can gain unauthorized access to secrets and config maps across namespaces by crafting resources such as HelmOp or Bundle with references to arbitrary secrets, provided they...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the valuesFrom process. An attacker can gain unauthorized access to secrets and config maps across namespaces by crafting resources such as HelmOp or Bundle with references to arbitrary secrets, provided they...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the valuesFrom process. An attacker can gain unauthorized access to secrets and config maps across namespaces by crafting resources such as HelmOp or Bundle with references to arbitrary secrets, provided they...

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the addLabelsFromOptions function. An attacker can overwrite security-sensitive namespace labels by pushing changes to a monitored repository, thereby weakening admission controls and enabling...

GHSA-864G-863M-VCVQ Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a...

GHSA-WHWG-VH4F-PMMF SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

In SurrealDB, records can be connected as a graph: a RELATE statement creates an edge record between two node records. If either endpoint node is deleted, SurrealDB automatically removes the edge row to keep the graph consistent. A user with permission to delete a node could also delete the edges...

GHSA-WP87-MGVQ-5J93 SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding DEFINE NAMESPACE or DEFINE DATABASE permission. USE NS and USE DB automatically create the target when it does not exist. The three places USE is handled — the RPC use method,...

SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization

An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding DEFINE NAMESPACE or DEFINE DATABASE permission. USE NS and USE DB automatically create the target when it does not exist. The three places USE is handled — the RPC use method,...

SurrealDB has unauthenticated remote DoS via malformed RPC `use` call

A single unauthenticated WebSocket message to /rpc crashed the SurrealDB server. Sending use db: "x" without first selecting a namespace hit .expect"namespace should be set" in the use handler; because surrealdb-core is built with panic = 'abort', the panic terminated the process. use is callable...

CVE-2026-53341

A flaw was found in the Linux kernel. This vulnerability, a Use-After-Free UAF, occurs in the fhandle component when the maydecodefh function accesses mount namespace information without proper locking. This creates a race condition that could be exploited by an attacker. The most severe...

CVE-2026-53341

In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked -mntns read in maydecodefh maydecodefh accesses mount::mntns without holding any locks; that means the mount can concurrently be unmounted, and the mntnamespace can concurrently be freed after an...

CVE-2026-53341

In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked -mntns read in maydecodefh maydecodefh accesses mount::mntns without holding any locks; that means the mount can concurrently be unmounted, and the mntnamespace can concurrently be freed after an...

UBUNTU-CVE-2026-53341

In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked -mntns read in maydecodefh maydecodefh accesses mount::mntns without holding any locks; that means the mount can concurrently be unmounted, and the mntnamespace can concurrently be freed after an...