Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.17 Images Update

New images are available for Red Hat build of Keycloak 26.0.17 and Red Hat build of Keycloak 26.0.17 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

CVE-2025-64171

A cross-namespace authorization flaw has been identified in the MARIN3R operator’s DiscoveryServiceCertificate resource. The flaw occurs because the operator mistakenly treats certain inputs as valid, bypassing Kubernetes Role-Based Access Control RBAC. When a user has permission to create...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: git-credential-oauth, logstash-exporter, manifest-tool, azure-ipam, prometheus-alertmanager, slsa-verifier, metacontroller, tfsec, terraform-provider-sendgrid, maru, glow, speedtest-go, secrets-store-csi-driver-provider-gcp, harbor-registry, src-fingerprint, wire-go,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: git-credential-oauth, logstash-exporter, manifest-tool, azure-ipam, prometheus-alertmanager, slsa-verifier, metacontroller, tfsec, terraform-provider-sendgrid, maru, glow, speedtest-go, secrets-store-csi-driver-provider-gcp, harbor-registry, src-fingerprint, wire-go,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: git-credential-oauth, logstash-exporter, manifest-tool, azure-ipam, prometheus-alertmanager, slsa-verifier, metacontroller, tfsec, terraform-provider-sendgrid, maru, glow, speedtest-go, harbor-registry, src-fingerprint, wire-go, docker-machine-driver-harvester,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: git-credential-oauth, logstash-exporter, manifest-tool, azure-ipam, prometheus-alertmanager, slsa-verifier, metacontroller, tfsec, terraform-provider-sendgrid, maru, glow, speedtest-go, secrets-store-csi-driver-provider-gcp, harbor-registry, src-fingerprint,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: git-credential-oauth, logstash-exporter, manifest-tool, azure-ipam, prometheus-alertmanager, slsa-verifier, metacontroller, tfsec, terraform-provider-sendgrid, maru, glow, speedtest-go, secrets-store-csi-driver-provider-gcp, harbor-registry, src-fingerprint, wire-go,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: git-credential-oauth, logstash-exporter, manifest-tool, azure-ipam, prometheus-alertmanager, slsa-verifier, metacontroller, tfsec, terraform-provider-sendgrid, maru, glow, speedtest-go, secrets-store-csi-driver-provider-gcp, harbor-registry, src-fingerprint, wire-go,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: renovate, terraform-provider-azuread, velero-plugin-for-microsoft-azure-fips, mods, minio-object-browser, terraform-provider-time, ucd, yace-fips, age, opensearch-k8s-operator, vault-k8s, prometheus-statsd-exporter-fips, go-bindata, vault-csi-provider, go-licenses,...

ROS-20251030-02

A vulnerability in the NVIDIA Virtual GPU Manager component of the NVIDIA Virtual GPU driver Virtual GPU is associated with incorrectly assigning permissions to a critical resource. Exploitation of the vulnerability could allow an attacker to cause a denial of service Vulnerability in the NVIDIA...

GHSA-Q8J9-34QF-7VQ7 Silver has unrestricted traffic between Wireguard clients

Summary Sliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to: 1. Leaked/recovered keypair from a beacon being used to attack operators. 2. Port forwardings usable from other implants. Details 1. Sliver treat operators' Wireguard config and...

ROS-20251028-11

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

CVE-2025-12103: Incorrect Privilege Assignment

A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role trustyai-service-operator-lmeval-user-role and a CRB...

ROS-20251028-10

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

langchainlanggraph-checkpoint-sqlite SQL injection vulnerability

langchainlanggraph-checkpoint-sqlite is an open source database connectivity Python library from LangChain. An SQL injection vulnerability exists in langchainlanggraph-checkpoint-sqlite version 2.0.10, which stems from improper handling of the filter operator and could lead to an SQL injection...

CVE-2025-47699

Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue affects Command Centre Server: 9.30 prior to...

CVE-2025-35981

Exposure of Private Personal Information to an Unauthorized Actor CWE-359 in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 MR1, 9.20.2337...

CVE-2025-48430

Uncaught Exception CWE-248 in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to vEL9.10.3672 MR7, 9.00 prior to...