PT-2026-56742

Multiple security vulnerabilities affect the prometheus-operator package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

PT-2026-56371

Multiple security vulnerabilities affect the minio-operator package. When returning errors, functions in the net/textproto package would include its input as part of the error. See references for individual vulnerability details...

Malicious code in grateful-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a7a07a0a09ed8037058353b9b9b067e25e3cbe783eaab8d54276d490f823471 On npm install, the package's postinstall script src/canary.js performs a DNS lookup and HTTPS GET to the hardcoded host...

GHSA-F6VJ-48FM-HMVX Apache Airflow has a Path Traversal issue

The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the handleGetAuditLog function. An attacker can access sensitive audit log information, including cross-tenant actor names, host and operator IDs, action timestamps, and masked IP entries, by using any operato...

GHSA-QM33-P5P9-F8VG nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to limit=1000. This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entrie...

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to limit=1000. This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entrie...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the handleGetAuditLog function. An attacker can access sensitive audit log information, including cross-tenant actor names, host and operator IDs, action timestamps, and masked IP entries, by using any operato...

GHSA-598G-H2VC-H5VG nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

The /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to missing ownership checks in multiple API endpoints, including those handling operators, hosts, networks, firewalls, and mobile-bundles. An attacker can gain unauthorized access to and control over resources...

CLEANSTART-2026-JI51299 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25518, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-26958, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-35469, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-pc3f-x583-g7j2 applied in versions: 1.18.0-r0, 1.18.0-r1, 1.18.0-r2, 1.18.0-r3, 1.18.0-r4, 1.18.0-r5

Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CL67452 Security fixes for CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-27145, CVE-2026-29181, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-35206, CVE-2026-35469, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, CVE-2026-46680, ghsa-fqw6-gf59-qr4w, ghsa-hfvc-g4fc-pqhx, ghsa-hr2v-4r36-88hr, ghsa-mh2q-q3fh-2475, ghsa-pc3f-x583-g7j2 applied in versions: 1.41.1-r0, 1.41.1-r1, 1.42.2-r0, 1.42.2-r1

Multiple security vulnerabilities affect the helm-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PH30270 Security fixes for CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-25680, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-33814, CVE-2026-39821, CVE-2026-39833, CVE-2026-39836, CVE-2026-42499, CVE-2026-42504, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-p436-gjf2-799p applied in versions: 7.1.1-r0, 7.1.1-r1, 7.1.1-r3, 7.1.1-r4, 7.1.1-r5

Multiple security vulnerabilities affect the minio-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MM70006 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, ghsa-66jq-2c23-2xh5, ghsa-9h8m-3fm2-qjrq applied in versions: 0.65.0-r0, 0.65.0-r1

Multiple security vulnerabilities affect the victoriametrics-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EF68467 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-39882, CVE-2026-39883, ghsa-hfvc-g4fc-pqhx, ghsa-w8rr-5gcm-pp58 applied in versions: 0.36.0-r0, 0.36.0-r1

Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UI72173 Security fixes for ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 25.10.0-r1

Multiple security vulnerabilities affect the gpu-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MO33100 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-39882, CVE-2026-39883, ghsa-hfvc-g4fc-pqhx, ghsa-w8rr-5gcm-pp58 applied in versions: 0.36.0-r0, 0.36.0-r1

Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ME43638 Security fixes for ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 25.10.0-r1

Multiple security vulnerabilities affect the gpu-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2

The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.21.2 release of Red Hat OpenShift Pipelines Operator...

CLEANSTART-2026-MW09143 Security fixes for CVE-2024-45337, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-33186, CVE-2026-34986, CVE-2026-39821, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, ghsa-6v2p-p943-phr9, ghsa-78h2-9frx-2jm8, ghsa-c6gw-w398-hv78, ghsa-f6x5-jh6r-wrfv, ghsa-hcg3-p754-cr77, ghsa-j5w8-q4qc-rx2x, ghsa-qxp5-gw88-xv66, ghsa-v778-237x-gjrc, ghsa-vvgc-356p-c3xw applied in versions: 1.15.0-r1, 1.19.0-r0, 1.19.1-r0, 1.19.2-r0

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...