GHSA-33MH-2634-FWR2 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, gitlab-cng, gitlab-rails-ce-fips, logstash, gitlab-rails-ce, cinc-auditor...

CVE-2026-25765 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kube-logging-operator, gitlab-cng, gitlab-rails-ce-fips, logstash, gitlab-rails-ce, cinc-auditor...

GHSA-W4GW-W5JQ-G9JH vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, gendesk, etcd, runc, terraform, nvidia-gpu-operator-validator, localstack, k8s-device-plugin, rke2-runtime, k3s, cilium-envoy, gitness, etcd-fips, gitlab-rails-ce, cilium-envoy-fips, backup-restore-operator, rke2-runtime-fips,...

CLEANSTART-2026-TR92727 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Multiple security vulnerabilities affect the prometheus-operator-fips package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should ha...

CLEANSTART-2026-CA79883 Security fixes for GHSA-6V2P-P943-PHR9, GHSA-C6GW-W398-HV78, GHSA-F6X5-JH6R-WRFV, GHSA-HCG3-P754-CR77, GHSA-J5W8-Q4QC-RX2X, GHSA-QXP5-GW88-XV66, GHSA-V778-237X-GJRC, GHSA-VVGC-356P-C3XW applied in versions: 1.15.0-r1

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the interpolation of untrusted agent metadata into tmux shell command strings executed through /bin/sh -c. An attacker can execute arbitrary commands on the operator host by supplying crafted metadata...

CVE-2026-2360

CVE-2026-2360 affects PostgreSQL Anonymizer. A vulnerability lets a user gain superuser privileges by creating a custom operator in the public schema, placing malicious code there, which is executed with superuser rights when the extension is created. Risk is higher on PostgreSQL 14 or when upgra...

CVE-2026-2360 Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is...

CVE-2026-2360

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is...

PT-2026-7633

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.0.1 Description The software contains a flaw that could allow a user to obtain superuser privileges. This is achieved by creating a custom operator within the public schema and embedding malicious code...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: zot, gitea, kargo, nfpm, bom, zarf, nuclei, argo-cd, steampipe, goreleaser, pulumi, snyk-cli, trufflehog, argocd-image-updater, witness, wolfictl, crossplane, kubescape, rancher-fleet, k9s, argo-workflows, flux, gptscript, src-fingerprint, pulumi-language-dotnet,...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: zot, gitea, kargo, nfpm, bom, zarf, nuclei, argo-cd, steampipe, goreleaser, pulumi, snyk-cli, trufflehog, argocd-image-updater, witness, wolfictl, crossplane, kubescape, rancher-fleet, k9s, argo-workflows, flux, gptscript, src-fingerprint, pulumi-language-dotnet,...

Important: Red Hat Security Advisory: DevWorkspace Operator 0.39.0 release.

DevWorkspace Operator 0.39.0 has been released. The DevWorkspace Operator extends OpenShift to provide DevWorkspace support...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: grpcurl, harbor-registry, dask-gateway, kuberlr, spire-controller-manager, cloud-provider-vsphere, cfssl, dive, dapr, yace, terraform-provider-grafana, crossplane-provider-aws-lambda, cloud-sql-proxy, timescaledb-parallel-copy, rancher-telemetry,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: grpcurl, harbor-registry, minify, dask-gateway, kuberlr, spire-controller-manager, helm-docs, cloud-provider-vsphere, cfssl, dive, dapr, yace, terraform-provider-grafana, crossplane-provider-aws-lambda, cloud-sql-proxy, timescaledb-parallel-copy, rancher-telemetry,...

CVE-2025-11142

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account...

CVE-2025-11142

The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account...

CVE-2025-11142

The CVE-2025-11142 vulnerability affects the VAPIX API mediaclip.cgi and arises from insufficient input validation, enabling potential remote code execution. Exploitation requires authentication with an operator- or administrator-privileged service account, and the impact is rated high (CVSSv3.1:...

PT-2026-7228

Name of the Vulnerable Software and Affected Versions VAPIX API affected versions not specified Description The VAPIX API’s mediaclip.cgi component lacks proper input validation, potentially allowing for remote code execution. Exploitation requires authentication with an operator- or...

AXIS OS 安全漏洞

AXIS OS is an edge device operating system developed by AXIS, a company from Sweden. There is a security vulnerability in AXIS OS, which stems from insufficient input validation. This vulnerability may allow for the execution of remote code after authentication is performed using a service accoun...