CVE-2025-4673 vulnerabilities

Vulnerabilities for packages: nri-jmx, kube-rbac-proxy, wire-go, logstash-exporter, k9s, nats, go-md2man, rancher-telemetry, openbao-k8s, cert-manager-istio-csr, prometheus-adapter, terraform-provider-random, nvidia-container-toolkit, scorecard, cloud-provider-aws, velero-plugin-for-aws, nri-f5,...

GHSA-62JJ-GR2R-5C34 vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter, cni-plugins, grpcurl, nvidia-nsight-compute-12.9, prometheus-postgres-exporter-fips, licenseclassifier, stakater-reloader-fips, go-bindata, rancher-helm, nginx-prometheus-exporter-fips, go-md2man, whereabouts-fips, contour,...

PT-2025-25495 · Ibm · Ibm Mq Operator +2

Name of the Vulnerable Software and Affected Versions: IBM MQ Operator LTS versions 2.0.0 through 2.0.29 IBM MQ Operator CD versions 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3 IBM MQ Operator SC2 versions 3.2.0 through 3.2.12 Description: The issue allows t...

CVE-2025-5282: Missing Authorization

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletepackage function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-runner (>=0.114.0, <=0.120.0) +6874 more potentially affected by CVE-2025-41234 via org.springframework:spring-web (>=6.2.0, <=6.2.7)

org.springframework:spring-web MAVEN version =6.2.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.17.0, =1.23.0 and more Source cves: CVE-2025-41234 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-10345766...

CVE-2025-2843

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with ClusterRole upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to the creation of a ServiceAccount with cluster-level privileges during deployment of a namespace-scoped custom resource. An attacker can gain elevated cluster-wide permissions by impersonating the...

Observability Operator security vulnerabilities

observability Operator is a Red Hat Observability open source software for creating required monitoring stacks on Kubernetes clusters. A security vulnerability exists in observability Operator that stems from the creation of a ServiceAccount with a ClusterRole, which could lead to elevated...

CVE-2025-27817 vulnerabilities

Vulnerabilities for packages: apache-nifi, wildfly, logstash, druid, apicurio-registry, opensearch, thingsboard, strimzi-kafka-operator, zipkin...

GHSA-VGQ5-3255-V292 vulnerabilities

Vulnerabilities for packages: apache-nifi, wildfly, logstash, druid, apicurio-registry, opensearch, thingsboard, strimzi-kafka-operator, zipkin...

CVE-2025-27817 vulnerabilities

Vulnerabilities for packages: logstash, strimzi-kafka-operator, zipkin, apicurio-registry, opensearch, druid, apache-nifi, wildfly, thingsboard...

GHSA-VGQ5-3255-V292 vulnerabilities

Vulnerabilities for packages: logstash, strimzi-kafka-operator, zipkin, apicurio-registry, opensearch, druid, apache-nifi, wildfly, thingsboard...

CVE-2025-48937 matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those event...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.16.4

The 1.16.4 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.16.4 release of Red Hat OpenShift Pipelines Operator...

Iranian Robbinhood Ransomware Operator Pleads Guilty in US City Attacks

Iranian Robbinhood ransomware operator pleads guilty to major US city attacks, crippling services in Baltimore, Greenville, and more since 2019...

SUSE CVE-2025-4057

A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies...

GO-2025-3717 ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse in github.com/arkmq-org/activemq-artemis-operator

ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse in github.com/arkmq-org/activemq-artemis-operator...

GHSA-WXR5-93PH-8WR9 vulnerabilities

Vulnerabilities for packages: confluent-common-docker, apache-nifi, sonarqube, cassandra-reaper, jenkins-plugin-manager, trino, tez, celeborn, wildfly, spdx-tools-java, druid, apicurio-registry, jenkins, akhq, opensearch, apache-activemq-artemis, strimzi-kafka-operator...

CVE-2025-48734 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, solr-fips, kafka, wildfly, solr, hadoop-client-modules, hadoop-fips, sonarqube, strimzi-kafka-operator, apache-nifi, jenkins, apache-activemq-artemis, neo4j, camunda-zeebe, apicurio-registry, druid, jenkins-plugin-manager, opensearch,...

Credential Reuse Attack

github.com/arkmq-org/activemq-artemis-operator is vulnerable to Credential Reuse Attack. The vulnerability is due to improper password management where the activemq-artemis-operator generating static passwords that do not regenerate between separate CR dependencies, which allows an attacker to ga...