CVE-2026-67269: Improper Privilege Management

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546

The MongoDB Controllers for Kubernetes are vulnerable to improper validation of Ops Manager backup configuration . An attacker with permissions to modify an OpsManager custom resource can trigger unintended administrative changes in Ops Manager. This vulnerability specifically impacts deployments...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: keycloak, wildfly, apache-nifi-registry, sonarqube, dependency-track, flyway, spdx-tools-java, strimzi-kafka-operator, akhq, infinispan, gradle, cass-config-builder, tez, spark, apache-nifi, scala, trino, apicurio-registry, logstash, apache-tika, keycloak-config-cli,...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: keycloak, wildfly, apache-nifi-registry, sonarqube, dependency-track, flyway, spdx-tools-java, strimzi-kafka-operator, akhq, infinispan, gradle, cass-config-builder, tez, spark, apache-nifi, scala, trino, apicurio-registry, logstash, apache-tika, keycloak-config-cli,...

PT-2026-104557

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules CSM Operator versions prior to 1.18.0 Description An improper privilege management issue exists in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this flaw t...

CVE-2026-104055

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: nacos, logstash, tez, apache-nifi, drain-cleaner, flink-kubernetes-operator, nuxeo, management-api-for-apache-cassandra-5.0, spark, pinot-fips, opensearch, pinot, jenkins-plugin-manager, kayenta-fips, apache-polaris, thingsboard, logstash-fips, cassandra-fips,...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: nacos, logstash, tez, apache-nifi, drain-cleaner, flink-kubernetes-operator, nuxeo, management-api-for-apache-cassandra-5.0, spark, pinot-fips, opensearch, pinot, jenkins-plugin-manager, kayenta-fips, apache-polaris, thingsboard, logstash-fips, cassandra-fips,...

GHSA-P6PP-M3F8-5C89 vulnerabilities

Vulnerabilities for packages: nacos, logstash, tez, apache-nifi, drain-cleaner, flink-kubernetes-operator, nuxeo, management-api-for-apache-cassandra-5.0, spark, pinot-fips, opensearch, pinot, jenkins-plugin-manager, kayenta-fips, apache-polaris, thingsboard, logstash-fips, cassandra-fips,...

CVE-2026-89407 vulnerabilities

Vulnerabilities for packages: nacos, logstash, tez, apache-nifi, drain-cleaner, flink-kubernetes-operator, nuxeo, management-api-for-apache-cassandra-5.0, spark, pinot-fips, opensearch, pinot, jenkins-plugin-manager, kayenta-fips, apache-polaris, thingsboard, logstash-fips, cassandra-fips,...

GHSA-P6PP-M3F8-5C89 vulnerabilities

Vulnerabilities for packages: wildfly, cassandra, jenkins-plugin-manager, sonarqube, dependency-track, flyway, spdx-tools-java, kserve-modelmesh, strimzi-kafka-operator, akhq, gradle, cass-config-builder, druid, tez, spark, celeborn, logstash, neo4j, cassandra-reaper, keycloak-config-cli,...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: wildfly, cassandra, jenkins-plugin-manager, sonarqube, dependency-track, flyway, spdx-tools-java, kserve-modelmesh, strimzi-kafka-operator, akhq, gradle, cass-config-builder, druid, tez, spark, celeborn, logstash, neo4j, cassandra-reaper, keycloak-config-cli,...

CVE-2026-89407 vulnerabilities

Vulnerabilities for packages: wildfly, cassandra, jenkins-plugin-manager, sonarqube, dependency-track, flyway, spdx-tools-java, kserve-modelmesh, strimzi-kafka-operator, akhq, gradle, cass-config-builder, druid, tez, spark, celeborn, logstash, neo4j, cassandra-reaper, keycloak-config-cli,...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: wildfly, cassandra, jenkins-plugin-manager, sonarqube, dependency-track, flyway, spdx-tools-java, kserve-modelmesh, strimzi-kafka-operator, akhq, gradle, cass-config-builder, druid, tez, spark, celeborn, logstash, neo4j, cassandra-reaper, keycloak-config-cli,...