CVE-2024-45041

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets resources. It...

CVE-2024-42457

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from kerberos 5, libxml2, go-jose, runc

Summary IBM MQ Operator and Queue manager container images are vulnerable to kerberos 5, libxml2, go-jose, runc. This bulletin identifies the steps required to address these vulnerabilities Vulnerability Details CVEID:CVE-2024-26461 DESCRIPTION: Kerberos 5 is vulnerable to a denial of service,...

The vulnerability of the IBM MQ Operator software, which manages containerized environments, stems from the use of cryptographic algorithms that contain defects. This allows attackers to exploit these vulnerabilities to disclose protected information.

The vulnerability of the IBM MQ Operator, a software tool for managing containerized environments, is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose protected information...

GHSA-3XG3-CGVQ-2XWR Twig security issue where escaping was missing when using null coalesce operator

When using the ?? operator, output escaping was missing for the expression on the left side of the operator...

Twig security issue where escaping was missing when using null coalesce operator

When using the ?? operator, output escaping was missing for the expression on the left side of the operator...

CVE-2025-24882 vulnerabilities

Vulnerabilities for packages: guac...

DEBIAN-CVE-2025-24374

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0...

CVE-2025-24374

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0...

CVE-2025-24374 Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0...

Missing output escaping for the null coalesce operator

More info at https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator...

Twig 注入漏洞

Twig is a PHP template engine from Twig open source. An injection vulnerability exists in Twig versions prior to 3.19.0, which stems from the lack of output escaping for expressions to the left of an operator when the operator is used...

PT-2025-5352 · Twig +1 · Twig +1

Name of the Vulnerable Software and Affected Versions: Twig versions prior to 3.19.0 Description: The issue concerns the Twig template language for PHP, where output escaping was missing when using the ?? operator, specifically for the expression on the left side of the operator. Recommendations:...

Security Bulletin: IBM DataPower Operator vulnerable to DoS due to use of Go (CVE-2024-34155, CVE-2024-34156)

Summary The affected calls are used by DataPower Operator for processing messages exchanged with Kubernetes and IBM DataPower Gateway. Vulnerability Details CVEID:CVE-2024-34156 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a stack exhaustion in Decoder.Decode. By sending...

Security Bulletin: IBM Security QRadar EDR Software contains a vulnerability (CVE-2024-6345)

Summary IBM Security QRadar EDR Software includes a vulnerable component e.g., framework libraries that could be identified and exploited with automated tools. This has been addressed in the update. Vulnerability Details CVEID:CVE-2024-6345 DESCRIPTION: pypa/setuptools could allow a remote attack...

CVE-2025-23054

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files,...

CVE-2024-13484 Openshift-gitops-operator-container: namespace isolation break

A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the...

CVE-2024-45341 vulnerabilities

Vulnerabilities for packages: skopeo-fips, etcd-fips, helm-operator, falco-exporter, osv-scanner, newrelic-fluent-bit-output, eck-operator, argo-events, cloudnative-pg, kubernetes-dashboard-fips, kpt, crossplane-provider-azure, docker-credential-ecr-login, sbomqs, beats, pdfcpu,...

CVE-2024-45336 vulnerabilities

Vulnerabilities for packages: skopeo-fips, etcd-fips, helm-operator, falco-exporter, osv-scanner, newrelic-fluent-bit-output, eck-operator, argo-events, cloudnative-pg, kubernetes-dashboard-fips, kpt, crossplane-provider-azure, docker-credential-ecr-login, sbomqs, beats, pdfcpu,...

PT-2025-2188

Name of the Vulnerable Software and Affected Versions openshift-gitops-operator-container affected versions not specified ArgoCD affected versions not specified Description A flaw was found in the software, allowing a namespace to create a rogue PrometheusRule when the...