Important: Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update

An updated OpenShift File Integrity Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift File Integrity Operator v1.5.0 is now available. See the documentation for bug fix information:...

rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection

A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...

Important: Red Hat Security Advisory: ruby:2.5 security update

An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

EUVD-2026-89959

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CVE-2026-101295

The oc-mirror tool is vulnerable to a path traversal and arbitrary file write flaw during the operator catalog image extraction process. When users mirror operator catalogs using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), the software fails to validate that extracted t...

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CLEANSTART-2026-BD94423 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the minio-operator package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-DQ91908 On Linux, if the target of Root

Security vulnerability affects the minio-operator package. On Linux, if the target of Root...

CLEANSTART-2026-MY04156 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the minio-operator package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-DP89465 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the minio-operator package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

CLEANSTART-2026-BX08713 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the minio-operator package. When returning errors, functions in the net/textproto package would include its input as part of the error...

CLEANSTART-2026-AI91182 tar

Security vulnerability affects the minio-operator package. tar...

CLEANSTART-2026-EL93151 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Security vulnerability affects the minio-operator package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...

CLEANSTART-2026-LW45744 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the minio-operator package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CLEANSTART-2026-CL14809 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Security vulnerability affects the minio-operator package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

CLEANSTART-2026-SL66487 On Unix systems, opening a file in an os

Security vulnerability affects the minio-operator package. On Unix systems, opening a file in an os...

CLEANSTART-2026-PU50619 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the minio-operator package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-YA72208 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the minio-operator package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...