PT-2025-25743 · Citrix · Citrix Netscaler

Name of the Vulnerable Software and Affected Versions: Citrix NetScaler affected versions not specified Description: A vulnerability allows an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code. Recommendations: At the moment, there is no...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2024-12133 DESCRIPTION: A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate,...

CVE-2025-36041

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose...

CVE-2025-36041

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose...

IBM MQ Operator 信任管理问题漏洞

IBM MQ Operator is a tool from International Business Machines IBM that is used to manage the lifecycle of IBM MQ Queue Manager. A trust management issue vulnerability exists in IBM MQ Operator that stems from a misconfiguration that could lead to disclosure of sensitive information or unauthoriz...

CVE-2025-22874 vulnerabilities

Vulnerabilities for packages: gosu, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, grafana-mimir, nri-nginx, trust-manager, pombump, redis-operator, temporal-ui-server, haproxy-ingress,...

GHSA-6F52-WPX2-HVF2 vulnerabilities

Vulnerabilities for packages: gosu, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, grafana-mimir, nri-nginx, trust-manager, pombump, redis-operator, temporal-ui-server, haproxy-ingress,...

GHSA-62JJ-GR2R-5C34 vulnerabilities

Vulnerabilities for packages: gosu, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, grafana-mimir, nri-nginx, trust-manager, redis-operator, temporal-ui-server, haproxy-ingress,...

CVE-2025-4673 vulnerabilities

Vulnerabilities for packages: gosu, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, grafana-mimir, nri-nginx, trust-manager, redis-operator, temporal-ui-server, haproxy-ingress,...

GHSA-62JJ-GR2R-5C34 vulnerabilities

Vulnerabilities for packages: newrelic-prometheus-configurator, op-geth, cass-operator-fips, azure-service-operator-fips, flux, nats-server-fips, jitsucom-bulker, velero-plugin-for-microsoft-azure, helm-docs, azuredisk-csi-fips, gcp-compute-persistent-disk-csi-driver-fips, lazydocker, linkerd2,...

PT-2025-25495 · Ibm · Ibm Mq Operator +2

Name of the Vulnerable Software and Affected Versions: IBM MQ Operator LTS versions 2.0.0 through 2.0.29 IBM MQ Operator CD versions 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3 IBM MQ Operator SC2 versions 3.2.0 through 3.2.12 Description: The issue allows t...

CVE-2025-2843

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with ClusterRole upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to the creation of a ServiceAccount with cluster-level privileges during deployment of a namespace-scoped custom resource. An attacker can gain elevated cluster-wide permissions by impersonating the...

observability Operator 安全漏洞

observability Operator is a Red Hat Observability open source software for creating required monitoring stacks on Kubernetes clusters. A security vulnerability exists in observability Operator that stems from the creation of a ServiceAccount with a ClusterRole, which could lead to elevated...

CVE-2025-27817 vulnerabilities

Vulnerabilities for packages: zipkin, apache-nifi, logstash, apicurio-registry, druid, opensearch, strimzi-kafka-operator, wildfly, thingsboard...

GHSA-VGQ5-3255-V292 vulnerabilities

Vulnerabilities for packages: zipkin, apache-nifi, logstash, apicurio-registry, druid, opensearch, strimzi-kafka-operator, wildfly, thingsboard...

CVE-2025-27817 vulnerabilities

Vulnerabilities for packages: apache-nifi, zipkin, thingsboard, druid, logstash, wildfly, opensearch, strimzi-kafka-operator, apicurio-registry...

GHSA-VGQ5-3255-V292 vulnerabilities

Vulnerabilities for packages: apache-nifi, zipkin, thingsboard, druid, logstash, wildfly, opensearch, strimzi-kafka-operator, apicurio-registry...

CVE-2025-48937 matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those event...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.16.4

The 1.16.4 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.16.4 release of Red Hat OpenShift Pipelines Operator...