61792 matches found
CLEANSTART-2026-GF75739 Security fixes in percona-xtradb-cluster-operator-fips 1.18.0-r5
Package percona-xtradb-cluster-operator-fips version 1.18.0-r5 fixes 9 vulnerabilities: CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-42506, CVE-2026-42502...
CLEANSTART-2026-OZ77297 Security fixes in tigera-operator 1.42.0-r0
Package tigera-operator version 1.42.0-r0 fixes 27 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33811, CVE-2026-33814...
CVE-2026-44097 File Upload vulnerability
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...
EUVD-2026-51032
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...
CVE-2026-44097
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...
CVE-2026-44097
The CVE-2026-44097 entry describes a low-privileged remote attacker with operator access who can upload arbitrary files through the firmware-update REST endpoint, leading to persistent attacker-controlled data and potential DoS via resource exhaustion. The root cause is an unrestricted file uploa...
CVE-2026-15240
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...
EUVD-2026-50996
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...
CVE-2026-15240
The Customer Switching WordPress plugin (versions before 2.1.3 ) contains a privilege escalation vulnerability due to insecure session binding. The plugin fails to securely link an active user-switching session to the operator who initiated it. This flaw allows a lower-privileged account—that an ...
CVE-2026-15240 Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...
PT-2026-85938
Package tigera-operator-fips version 1.37.2-r0 fixes 2 vulnerabilities: ghsa-6v2p-p543-phr9, ghsa-mf24-chxh-hmvj...
PT-2026-86003
Package minio-operator-fips version 7.0.1-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
PT-2026-85988
Package eck-operator version 3.2.0-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
PT-2026-85867
Package prometheus-operator-fips version 0.87.0-r1 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
PT-2026-86089
Package kube-logging-operator version 6.2.2-r0 fixes 6 vulnerabilities: ghsa-mxw3-3hh2-x2mh, ghsa-jfh8-c2jp-hdph, ghsa-v9wx-v5z4-wgfj, ghsa-59gp-qqm7-cw4j, ghsa-g7gv-6qhm-4h2j...
PT-2026-85929
Package minio-operator-fips version 7.1.1-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
PT-2026-66459
Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...
PT-2026-85946
Package helm-operator version 1.42.3-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...