CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: akhq, cass-config-builder, apache-nifi, tez, sonarqube, keycloak, logstash, apache-tika, spdx-tools-java, apache-nifi-registry, wildfly, keycloak-config-cli, apicurio-registry, spark, strimzi-kafka-operator, scala, dependency-track, opensearch, trino, flyway,...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: akhq, cass-config-builder, apache-nifi, tez, sonarqube, keycloak, logstash, apache-tika, spdx-tools-java, apache-nifi-registry, wildfly, keycloak-config-cli, apicurio-registry, spark, strimzi-kafka-operator, scala, dependency-track, opensearch, trino, flyway,...

PT-2026-104557

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules CSM Operator versions prior to 1.18.0 Description An improper privilege management issue exists in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this flaw t...

CVE-2026-104055

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: airbyte-platform-fips, flyway, apache-tomee, apache-nifi-registry, cass-config-builder, apache-polaris, floci-az, datahub-gms, pinot, spdx-tools-java, reposilite, logstash-fips, knative-kafka-broker, mongodb-search, strimzi-kafka-operator, kafka-bridge-fips, logstash...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: airbyte-platform-fips, flyway, apache-tomee, apache-nifi-registry, cass-config-builder, apache-polaris, floci-az, datahub-gms, pinot, spdx-tools-java, reposilite, logstash-fips, knative-kafka-broker, mongodb-search, strimzi-kafka-operator, kafka-bridge-fips, logstash...

CVE-2026-89407 vulnerabilities

Vulnerabilities for packages: airbyte-platform-fips, flyway, apache-tomee, apache-nifi-registry, cass-config-builder, apache-polaris, floci-az, datahub-gms, pinot, spdx-tools-java, reposilite, hadoop-fips, logstash-fips, knative-kafka-broker, mongodb-search, strimzi-kafka-operator,...

GHSA-P6PP-M3F8-5C89 vulnerabilities

Vulnerabilities for packages: airbyte-platform-fips, flyway, apache-tomee, apache-nifi-registry, cass-config-builder, apache-polaris, floci-az, datahub-gms, pinot, spdx-tools-java, reposilite, hadoop-fips, logstash-fips, knative-kafka-broker, mongodb-search, strimzi-kafka-operator,...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: akhq, cass-config-builder, tez, sonarqube, logstash, spdx-tools-java, management-api-for-apache-cassandra-5.0, neo4j, wildfly, keycloak-config-cli, spark, wavefront-proxy, jenkins-plugin-manager, strimzi-kafka-operator, cassandra, dependency-track, cassandra-reaper,...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: akhq, cass-config-builder, tez, sonarqube, logstash, spdx-tools-java, management-api-for-apache-cassandra-5.0, neo4j, wildfly, keycloak-config-cli, spark, wavefront-proxy, jenkins-plugin-manager, strimzi-kafka-operator, cassandra, dependency-track, cassandra-reaper,...

GHSA-P6PP-M3F8-5C89 vulnerabilities

Vulnerabilities for packages: akhq, cass-config-builder, tez, sonarqube, logstash, spdx-tools-java, management-api-for-apache-cassandra-5.0, neo4j, wildfly, keycloak-config-cli, spark, wavefront-proxy, jenkins-plugin-manager, strimzi-kafka-operator, cassandra, dependency-track, cassandra-reaper,...

CVE-2026-89407 vulnerabilities

Vulnerabilities for packages: akhq, cass-config-builder, tez, sonarqube, logstash, spdx-tools-java, management-api-for-apache-cassandra-5.0, neo4j, wildfly, keycloak-config-cli, spark, wavefront-proxy, jenkins-plugin-manager, strimzi-kafka-operator, cassandra, dependency-track, cassandra-reaper,...

GO-2026-6596 vulnerabilities

Vulnerabilities for packages: cilium, kubescape, kubescape-operator, hubble, hubble-ui...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: k8sgpt, tigera-operator, flux-helm-controller, cert-manager-cmctl, helm-push, cluster-api-helm-controller, k9s, opentofu, kyverno-notation-aws, helm-mapkubeapis, kargo, rancher-helm, helm-set-status, xeol, kube-arangodb, maru, manifest-tool, gitness...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: k8sgpt, tigera-operator, flux-helm-controller, cert-manager-cmctl, helm-push, cluster-api-helm-controller, k9s, opentofu, kyverno-notation-aws, helm-mapkubeapis, kargo, rancher-helm, helm-set-status, xeol, kube-arangodb, maru, manifest-tool, gitness...

GO-2026-6597 vulnerabilities

Vulnerabilities for packages: k8sgpt, wolfictl, spegel, trivy, helm-mapkubeapis, chartmuseum, zarf, helm-set-status, xeol, neuvector-scanner, buildkitd, rancher, headlamp, scorecard, helm-operator, docker-compose, k9s, falco-no-driver, helm-push, skaffold, eksctl, kubescape, kubevela,...

CVE-2026-104055 Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

CVE-2026-104055

The postgresql-operator charm contains a vulnerability where the Prometheus postgres_exporter writes the monitoring user's password in cleartext to its logs during database connection errors. An attacker with log-reading permissions can recover this password to gain read-only pg_monitor access to...