SUSE CVE-2026-9277

shell-quote's quote function did not validate object-token inputs against the operator model used by parse. The .op field was backslash-escaped character by character using /./g, which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in .op therefore passed...

CVE-2026-45363 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, kube-fluentd-operator, cinc-auditor...

GHSA-C32J-VQHX-RX3X vulnerabilities

Vulnerabilities for packages: kube-logging-operator, kube-fluentd-operator, cinc-auditor...

GHSA-C32J-VQHX-RX3X vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, logstash, kube-fluentd-operator, cinc-auditor, kube-logging-operator, gitlab-rails-ce-fips...

CVE-2026-45363 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, logstash, kube-fluentd-operator, cinc-auditor, kube-logging-operator, gitlab-rails-ce-fips...

PT-2026-43265

Name of the Vulnerable Software and Affected Versions Apache Flink Kubernetes Operator versions 1.3.0 through 1.14.x Description A Server-Side Request Forgery SSRF and local file access issue exists where the jarURI in FlinkSessionJob is not validated. This allows a user with CR create permission...

ZTE ZXUniPOS NDS-LTE security vulnerabilities

ZTE ZXUniPOS NDS-LTE is an operator network positioning platform developed by ZTE Corporation. ZTE ZXUniPOS NDS-LTE has a security vulnerability, which stems from business logic defects. Attackers can exploit the features of legitimate applications in an unintended and abnormal manner to carry ou...

Apache Flink Kubernetes Operator security vulnerabilities

Apache Flink Kubernetes Operator is an operations component for Flink clusters developed by the Apache Foundation. Versions of Apache Flink Kubernetes Operator from 1.3.0 to 1.15.0 contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of the jarURI in...

CVE-2026-40564: Files or Directories Accessible to External Parties

Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...

prefect-yeedu-operator (>=1.0.4, <=1.0.8), viadot2 (>=2.1.12, <=2.15.0) potentially affected by CVE-2026-3515 via prefect-github (>=0.2.6, <=0.4.1)

prefect-github PYPI version =0.2.6, =1.0.4, =2.1.12, =2.15.0 Source cves: CVE-2026-3515 Source advisory: MEND:CVE-2026-3515...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: opa-envoy, buildkitd, rancher, envoy-gateway, helm-set-status, docker-compose, kaniko, teleport, fuse-overlayfs-snapshotter, kubescape, opa, kots, headlamp, helm-push, skaffold, helm-mapkubeapis, syft, cluster-api-helm-controller, spegel, linkerd2, steampipe, zot,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: opa-envoy, buildkitd, rancher, envoy-gateway, helm-set-status, docker-compose, kaniko, teleport, fuse-overlayfs-snapshotter, kubescape, opa, kots, headlamp, helm-push, skaffold, helm-mapkubeapis, syft, cluster-api-helm-controller, spegel, linkerd2, steampipe, zot,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: kube-mgmt-fips, chaos-mesh, cloudbeat-fips, grype, k9s-fips, gitlab-rails-ce-fips, tigera-operator-fips, wolfictl, docker-compose, kots, chainctl, buildkitd, gogatekeeper, helm-push, kubescape, headlamp, consul-k8s, envoy-gateway, trivy-operator, livekit-cli,...

CVE-2026-9277

shell-quote's quote function did not validate object-token inputs against the operator model used by parse. The .op field was backslash-escaped character by character using /./g, which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in .op therefore passed...

CVE-2026-9277 shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

shell-quote's quote function did not validate object-token inputs against the operator model used by parse. The .op field was backslash-escaped character by character using /./g, which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in .op therefore passed...

PT-2026-42766

Name of the Vulnerable Software and Affected Versions shell-quote versions prior to 1.8.4 Description The quote function fails to validate object-token inputs against the operator model used by parse. Specifically, the .op field is escaped using a regular expression that does not match line...

org.open-metadata:openmetadata-dist (>=1.0.0-alpha, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.0-rc1, <=1.12.3) +1 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=1.0.0-alpha, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =1.0.0-alpha, =1.0.0-alpha, =1.12.0-rc1, =1.9.0, =1.12.3 Source cves: CVE-2026-46481 Source advisory: OSV:GHSA-9VMH-WHC4-7PHG...

org.open-metadata:openmetadata-dist (>=1.12.1, <=1.12.3), org.open-metadata:openmetadata-k8s-operator (>=1.12.1, <=1.12.3) +1 more potentially affected by CVE-2026-46481 via org.open-metadata:openmetadata-service (>=1.12.1, <=1.12.3)

org.open-metadata:openmetadata-service MAVEN version =1.12.1, =1.12.1, =1.12.1, =1.12.1, =1.12.3 Source cves: CVE-2026-46481 Source advisory: SNYK:JAVA-ORGOPENMETADATA-16874299...

Malicious code in oh-langfuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83b229927c5bc228764ab11651b10bd06c6ff61edffa820a632c343aeec13037 The package configures Langfuse tracing for Claude Code, Codex, and OpenCode. When the operator runs the bundled CLI without explicitly overriding...

CLEANSTART-2026-TL66481 Security fixes for CVE-2024-24786, CVE-2024-35255, CVE-2025-22868, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-40179, CVE-2026-42151, CVE-2026-42154, CVE-2026-42499, CVE-2026-42501, CVE-2026-44903, ghsa-8rm2-7qqf-34qm, ghsa-fw8g-cg8f-9j28, ghsa-vffh-x6r8-xx99, ghsa-wg65-39gg-5wfj applied in versions: 0.69.1-r0, 0.69.1-r1, 0.87.1-r0, 0.89.0-r0

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...