GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: kots, kargo, linkerd2, rancher-fleet, cloudbeat, kubescape-server, eksctl, helm-operator-fips, helm-exporter-fips, k9s-fips, tigera-operator, cloudbeat-fips, helm, cilium-cli, oras-fips, zarf-fips, kyverno-fips, falcoctl, headlamp-fips, kube-mgmt-fips, ratify,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: kots, kargo, linkerd2, rancher-fleet, cloudbeat, kubescape-server, eksctl, helm-operator-fips, helm-exporter-fips, k9s-fips, tigera-operator, cloudbeat-fips, helm, cilium-cli, oras-fips, zarf-fips, kyverno-fips, falcoctl, headlamp-fips, kube-mgmt-fips, ratify,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: kots, kargo, linkerd2, rancher-fleet, cloudbeat, kubescape-server, eksctl, harvester-fips, helm-operator-fips, helm-exporter-fips, k9s-fips, tigera-operator, cloudbeat-fips, helm, cilium-cli, oras-fips, zarf-fips, kyverno-fips, falcoctl, headlamp-fips, kube-mgmt-fips...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: kots, kargo, linkerd2, rancher-fleet, cloudbeat, kubescape-server, eksctl, helm-operator-fips, helm-exporter-fips, k9s-fips, tigera-operator, cloudbeat-fips, helm, cilium-cli, oras-fips, zarf-fips, kyverno-fips, falcoctl, headlamp-fips, kube-mgmt-fips, ratify,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: kots, kargo, linkerd2, rancher-fleet, cloudbeat, kubescape-server, eksctl, helm-operator-fips, helm-exporter-fips, k9s-fips, tigera-operator, cloudbeat-fips, helm, cilium-cli, oras-fips, zarf-fips, kyverno-fips, falcoctl, headlamp-fips, kube-mgmt-fips, ratify,...

PT-2026-55406

Summary Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity. This advisory is scoped to the named feature and configuration. It does not change...

PT-2026-55423

Summary Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently. This advisory is scoped to the named feature and configuration. It does not change...

PT-2026-55382

Summary Workspace .env could override Homebrew executable selection for skill install flows. In affected versions, a workspace .env in a repository opened by a trusted operator could override the Homebrew executable used by the install helper. This advisory is scoped to the named feature and...

CVE-2026-49835 vulnerabilities

Vulnerabilities for packages: tkn, goreleaser, falcoctl, policy-controller, spire-server, ratify, zarf, kyverno, tekton-chains, crossplane, kubescape, neuvector-sigstore-interface, kyverno-notation-aws, trivy, gitsign, trivy-operator, aactl, tflint...

GHSA-9C54-X2G4-V92J vulnerabilities

Vulnerabilities for packages: tkn, goreleaser, falcoctl, policy-controller, spire-server, ratify, zarf, kyverno, tekton-chains, crossplane, kubescape, neuvector-sigstore-interface, kyverno-notation-aws, trivy, gitsign, trivy-operator, aactl, tflint...

Critical: Red Hat Security Advisory: Cluster Observability Operator 1.5.0

The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5 release of COO...

GHSA-8X9C-RMQH-456C Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Description This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguarded toString calls. It covers two related coercion points that were not caught by the original patch. Traversable in join and replace filters. SandboxExtension::ensureToStringAllowed...

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Description This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguarded toString calls. It covers two related coercion points that were not caught by the original patch. Traversable in join and replace filters. SandboxExtension::ensureToStringAllowed...

Security Bulletin: NVIDIA Container Toolkit - June 2026

NVIDIA has released a software update for NVIDIA® Container Toolkit. To protect your system, install the software update as described in the installation section of the NVIDIA Container Toolkit documentation. Go to NVIDIA Product Security. Details The following table summarizes the potential...

Incorrect Authorization

Overview mythic is an Interact with Mythic C2 Framework Instances Affected versions of this package are vulnerable to Incorrect Authorization due to a broken permission filter in the payloadbuildstep table, which uses an always-satisfied or condition that bypasses operation-scoped access controls...

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value || ---------------- | ----- || Repository | pipeboard-co/meta-ads-mcp || Affected version | ≤ 1.0.101 commit 496c988 7d14226; Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. ||...

PYSEC-2026-413 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository | pipeboard-co/meta-ads-mcp | | Affected version | ≤ 1.0.101 commit 496c988 7d14226; Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. | |...

PT-2026-53495

Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository | pipeboard-co/meta-ads-mcp | | Affected version | ≤ 1.0.101 commit 496c988 7d14226; Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. | |...

Continuous-Variable Source-Independent Quantum Random Number Generation with General POVMs

Continuous-variable source-independent quantum random number generators offer the highest generation rates among semi-device-independent protocols. In reality, the protocol design is limited due to permissible measurement configurations. In this work, we propose a rigorous security proof framewor...

CVE-2026-46604 vulnerabilities

Vulnerabilities for packages: mattermost-fips, seaweedfs-operator-fips, rclone-fips, seaweedfs-fips, seaweedfs, mattermost, seaweedfs-operator, hugo, rclone, gitlab-workhorse-ce, listmonk...