GHSA-H8W8-99G7-QMVJ vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, cinc-auditor, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.4-rails, ruby3.2-rails, ruby4.0-rails, logstash-fips, commercial-gitlab-rails-ee, ruby3.3-rails,...

CVE-2026-54906 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, cinc-auditor, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.4-rails, ruby3.2-rails, ruby4.0-rails, logstash-fips, commercial-gitlab-rails-ee, ruby3.3-rails,...

CVE-2026-54905 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, cinc-auditor, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.4-rails, ruby3.2-rails, ruby4.0-rails, logstash-fips, commercial-gitlab-rails-ee, ruby3.3-rails,...

GHSA-WV3X-4VXV-WHPP vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, cinc-auditor, ruby3.3-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.4-rails, ruby3.2-rails, ruby4.0-rails, logstash-fips, commercial-gitlab-rails-ee, ruby3.3-rails,...

GHSA-98M9-HRRM-R99R vulnerabilities

Vulnerabilities for packages: ruby3.3-faraday, kube-fluentd-operator, kube-logging-operator, gitlab-rails-ce-fips, cinc-auditor, gitlab-rails-ce, gitlab-cng, logstash-fips, logstash...

CVE-2026-54297 vulnerabilities

Vulnerabilities for packages: ruby3.3-faraday, kube-fluentd-operator, kube-logging-operator, gitlab-rails-ce-fips, cinc-auditor, gitlab-rails-ce, gitlab-cng, logstash-fips, logstash...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: kubescape-operator, google-osconfig-agent, kots, docker-cli-buildx, kargo, linkerd2, amazon-ecs-agent-fips, cloudbeat, kubescape-server, eksctl, harvester-fips, helm-operator-fips, helm-exporter-fips, wolfictl, k9s-fips, datadog-agent, tigera-operator, cloudbeat-fips...

CVE-2025-62879 vulnerabilities

Vulnerabilities for packages: backup-restore-operator, backup-restore-operator-fips...

GHSA-WJ3P-5H3X-C74Q vulnerabilities

Vulnerabilities for packages: backup-restore-operator, backup-restore-operator-fips...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: percona-xtradb-cluster-operator-fips, trident, velero-plugin-for-gcp-fips, gomplate-fips, kubo, witness, vault-fips, kiali, kargo, knative-eventing-fips, percona-server-mongodb-operator-fips, gatus, rancher-fleet, crossplane-provider-sql, caddy, ansible-operator-fips...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: percona-xtradb-cluster-operator-fips, trident, velero-plugin-for-gcp-fips, gomplate-fips, kubo, witness, vault-fips, kiali, kargo, knative-eventing-fips, percona-server-mongodb-operator-fips, gatus, rancher-fleet, crossplane-provider-sql, caddy, ansible-operator-fips...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: kubescape-operator, google-osconfig-agent, kots, docker-cli-buildx, kargo, linkerd2, amazon-ecs-agent-fips, cloudbeat, kubescape-server, eksctl, harvester-fips, helm-operator-fips, helm-exporter-fips, wolfictl, k9s-fips, datadog-agent, tigera-operator, cloudbeat-fips...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: kubescape-operator, google-osconfig-agent, kots, docker-cli-buildx, kargo, linkerd2, amazon-ecs-agent-fips, cloudbeat, kubescape-server, eksctl, harvester-fips, helm-operator-fips, helm-exporter-fips, wolfictl, k9s-fips, datadog-agent, tigera-operator, cloudbeat-fips...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.3.2. Vulnerability Details CVEID:CVE-2026-27145 DESCRIPTION:x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused...

CVE-2026-10609: Missing Authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-23513: Incorrect Authorization

FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. Details In ServiceTransaction::getSearchQuery and...

PT-2026-51518

Name of the Vulnerable Software and Affected Versions OpenShift Cluster Logging Operator affected versions not specified Description A missing authorization flaw exists in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations withou...

Important: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.4.1 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

EUVD-2026-38234

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54100 Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...