Authorization Bypass

Apache Camel is vulnerable to Authorization Bypass. The vulnerability is due to insufficient validation of user-controlled Build resources, which allows an authorized attacker to generate Pods in arbitrary Kubernetes namespaces, including the operator namespace...

SUSE CVE-2026-47770

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion uncontrolled recursion. The crash occurs in jq's recursive...

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

GHSA-C6V2-3FFM-VCMC Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.3.3. Vulnerability Details CVEID:CVE-2026-45447 DESCRIPTION: Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: cert-manager, vault-fips, argo-workflows-fips, kots, frankenphp-8.4, prometheus-mongodb-exporter, minio, aactl, knative-eventing-fips, vault, cloudbeat, kubescape-server, k9s-fips, istio, tigera-operator, cloudbeat-fips, flux-source-controller-fips, helm, coder,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: cert-manager, vault-fips, argo-workflows-fips, kots, frankenphp-8.4, prometheus-mongodb-exporter, minio, aactl, knative-eventing-fips, vault, cloudbeat, kubescape-server, k9s-fips, istio, tigera-operator, cloudbeat-fips, flux-source-controller-fips, helm, coder,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: cert-manager, gomplate-fips, witness, vault-fips, argo-workflows-fips, kots, frankenphp-8.4, prometheus-mongodb-exporter, minio, aactl, pulumi-kubernetes-operator, knative-eventing-fips, vault, cloudbeat, kubescape-server, terragrunt-fips, splunk-otel-collector-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: rancher-machine, cert-manager, rootlesskit-fips, gomplate-fips, witness, vault-fips, argo-workflows-fips, kots, frankenphp-8.4, prometheus-mongodb-exporter, minio, aactl, pulumi-kubernetes-operator, gatus-fips, docker-cli-buildx, knative-eventing-fips,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: rancher-machine, crossplane-provider-azure-portal, cert-manager, rootlesskit-fips, gomplate-fips, witness, vault-fips, argo-workflows-fips, kots, frankenphp-8.4, prometheus-mongodb-exporter, crossplane-provider-azure-operationalinsights, aactl, minio, gatus-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: gomplate-fips, witness, vault-fips, frankenphp-8.4, kargo, knative-eventing-fips, gatus, caddy, sops, crossplane-provider-aws-cloudsearch, eksctl, crossplane-provider-aws-sesv2-fips, crossplane-provider-aws-acm, wolfictl, tigera-operator,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: gomplate-fips, witness, vault-fips, frankenphp-8.4, kargo, knative-eventing-fips, gatus, caddy, sops, crossplane-provider-aws-cloudsearch, eksctl, crossplane-provider-aws-sesv2-fips, crossplane-provider-aws-acm, wolfictl, tigera-operator,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: rancher-machine, crossplane-provider-azure-portal, cert-manager, rootlesskit-fips, gomplate-fips, witness, vault-fips, argo-workflows-fips, kots, frankenphp-8.4, prometheus-mongodb-exporter, crossplane-provider-azure-operationalinsights, aactl, minio, gatus-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: zarf, crossplane-provider-aws-ec2, mods, k8sgpt, slsa-verifier, gitlab-kas, fulcio, act, flux-image-automation-controller, docker-machine-driver-linode, loki, podman, syft, step, nuclei, apko, chezmoi, tflint, ksops, buildah, crossplane-provider-aws-dynamodb, openbao...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: zarf, mods, k8sgpt, slsa-verifier, gitlab-kas, fulcio, act, flux-image-automation-controller, loki, podman, syft, step, nuclei, apko, chezmoi, tflint, ksops, buildah, openbao, step-kms-plugin, kubescape, docker-cli-buildx, zot, trivy, flux-notification-controller,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: zarf, kaf, kyverno, rancher-agent, kubernetes, osv-scanner, k9s, minio, istio, gitea, gitlab-kas, fscrypt, skaffold, flux-source-controller, kine, external-secrets-operator, prometheus, prometheus-operator, chisel, spire-server, flux-image-automation-controller,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: kaf, kyverno, rancher-agent, kubernetes, minio, istio, gitlab-kas, fscrypt, kine, external-secrets-operator, prometheus, prometheus-operator, spire-server, falco-no-driver, external-dns, cilium, loki, rancher, podman, kubernetes-dashboard, opentelemetry-collector,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: zarf, crossplane-provider-aws-ec2, mods, k8sgpt, slsa-verifier, gitlab-kas, fulcio, act, flux-image-automation-controller, docker-machine-driver-linode, loki, podman, syft, step, nuclei, apko, chezmoi, tflint, ksops, buildah, crossplane-provider-aws-dynamodb, openbao...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...