GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-cmctl, step-issuer, cert-manager-istio-csr, percona-server-mongodb-operator, aws-privateca-issuer, cert-manager-csi-driver, mariadb-operator, opentelemetry-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: mariadb-operator, percona-xtradb-cluster-operator-fips, cert-manager-google-cas-issuer, cert-manager-openshift-routes-fips, percona-server-mongodb-operator, cert-manager-webhook-pdns-fips, aws-privateca-issuer, step-issuer, aws-privateca-issuer-fips, gitlab-operator,...

CVE-2026-25233 PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0...

CVE-2026-25233 PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0...

CVE-2026-25233 PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0...

Important: Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update

An updated OpenShift Compliance Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift Compliance Operator v1.8.2 is now available. See the documentation for bug fix information:...

Malicious code in transform-exponentiation-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b79481ce559cb600cfe4b2897847eb06d38b5cbe4ef456339cbbac7b240e60 The package transform-exponentiation-operator was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview transform-exponentiation-operator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

MAL-2026-665 Malicious code in transform-exponentiation-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b79481ce559cb600cfe4b2897847eb06d38b5cbe4ef456339cbbac7b240e60 The package transform-exponentiation-operator was found to contain malicious code. Source: ghsa-malware...

PT-2026-6506

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...

GO-2026-4351 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator...

GHSA-G9Q4-QJX4-2V7Q vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, cosign, cert-manager-cmctl, osv-scanner, falco-no-driver, src, helm-set-status, fuse-overlayfs-snapshotter, nerdctl, opensearch-k8s-operator, runc, kubernetes-dashboard, mattermost, kubeflow-katib, flux-notification-controller,...

CVE-2025-61728 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, cosign, cert-manager-cmctl, osv-scanner, falco-no-driver, src, helm-set-status, fuse-overlayfs-snapshotter, nerdctl, opensearch-k8s-operator, runc, kubernetes-dashboard, mattermost, kubeflow-katib, flux-notification-controller,...

CVE-2025-61731 vulnerabilities

Vulnerabilities for packages: vault-k8s, flux-notification-controller, sftpgo-plugin-auth, kapp-controller, kuberlr, ferretdb, rabbitmq-default-user-credential-updater, yace, sops, helm-docs, flux-image-automation-controller, crossplane-provider-aws-cloudformation, gitleaks, falcosidekick,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: dbmate, cosign, lvm-driver, rabbitmq-cluster-operator, crossplane-provider-aws-ec2, kustomize, helm-set-status, grpcurl, vault-k8s, kubernetes-dashboard, azure-workload-identity-webhook, mattermost, gptscript, flux-notification-controller, ytt, sftpgo-plugin-auth,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: vault-k8s, flux-notification-controller, sftpgo-plugin-auth, kapp-controller, kuberlr, ferretdb, rabbitmq-default-user-credential-updater, yace, sops, helm-docs, flux-image-automation-controller, crossplane-provider-aws-cloudformation, gitleaks, falcosidekick,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: dbmate, cosign, lvm-driver, rabbitmq-cluster-operator, crossplane-provider-aws-ec2, kustomize, helm-set-status, grpcurl, vault-k8s, kubernetes-dashboard, azure-workload-identity-webhook, mattermost, gptscript, flux-notification-controller, ytt, sftpgo-plugin-auth,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: vault-k8s, flux-notification-controller, sftpgo-plugin-auth, kapp-controller, kuberlr, ferretdb, rabbitmq-default-user-credential-updater, yace, sops, helm-docs, flux-image-automation-controller, crossplane-provider-aws-cloudformation, gitleaks, falcosidekick,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: vault-k8s, flux-notification-controller, sftpgo-plugin-auth, kapp-controller, kuberlr, ferretdb, rabbitmq-default-user-credential-updater, yace, sops, helm-docs, flux-image-automation-controller, crossplane-provider-aws-cloudformation, gitleaks, falcosidekick,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: dbmate, cosign, lvm-driver, rabbitmq-cluster-operator, crossplane-provider-aws-ec2, kustomize, helm-set-status, grpcurl, vault-k8s, kubernetes-dashboard, azure-workload-identity-webhook, mattermost, gptscript, flux-notification-controller, ytt, sftpgo-plugin-auth,...