CVE-2026-19633

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the...

CVE-2021-48006 PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

EUVD-2021-34876

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

CVE-2021-48006

PocketMine-MP versions before 4.0.3 contain a case-sensitivity flaw in the removeOp function. When the deop command is issued, the function lowercases the supplied operator name but then performs an exact-match removal from ops.txt . As a result, any operator whose name was stored with uppercase ...

PT-2026-86535

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.1.4 Description Unprivileged masked users can execute arbitrary code by abusing operators, domain casts, or view subqueries that contain untrusted expressions. This occurs when these objects are...

Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit

The /v1/chat/agents/agentid/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied filepath with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolute...

PYSEC-2026-4010 Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit

The /v1/chat/agents/agentid/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied filepath with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolute...

PYSEC-2026-4009 Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator

The /v1/agents/import endpoint and AgentRegistry.importagent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree and...

Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator

The /v1/agents/import endpoint and AgentRegistry.importagent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree and...

SUSE CVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

PT-2026-105771

The /v1/chat/agents/agent id/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied file path with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolu...

PT-2026-105770

The /v1/agents/import endpoint and AgentRegistry.import agent in local-operator versions before 0.47.5 trust the id field inside agent.yml of an uploaded agent profile archive when constructing the destination directory. A crafted id containing directory traversal sequences makes shutil.rmtree an...

CVE-2026-53602

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-63464

CVE-2026-63464 affects nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, in versions 0.6.0 through before 0.7.2 . The vulnerability is an SSRF that arises because non-admin operators (role user) can set allow_private: true on their own webhook subscription via POST/PATCH /api/v...

CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-53603

nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, stored operator session tokens in plaintext in the operator_sessions table (the token column served as the PRIMARY KEY). Each token is a 32-byte random hex value delivered via cookie with a 24-hour validity. Unlike API keys and ...

EUVD-2026-71715

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...

CVE-2026-19274

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19283

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...