CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass in the ListArchivedWorkflows API. The root cause is a failure to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals (negated) operator . An attacker with namespace-scoped list...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CLEANSTART-2026-BI76968 privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration

Security vulnerability affects the vault package. A privileged Vault operator within the root namespace with write permission to sys/audit may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration...

CVE-2026-93760

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

EUVD-2026-83210

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

CVE-2026-93760

Mongoid , the Ruby ODM for MongoDB, allows caller-supplied filter data to carry unrestricted query operators when an application forwards externally supplied parameters to its query-building methods. Because the operator guard is unsafe by default , an unauthenticated party can influence how the ...

CVE-2026-93760 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

CVE-2026-47886

A flaw was found in Spring Framework. Applications that process user-supplied Spring Expression Language SpEL expressions are vulnerable to a Denial of Service DoS attack. This occurs when the power operator ^ is used with large numerical operands, leading to excessive resource consumption. A...

CLEANSTART-2026-GA56575 Security fix for ghsa-x4rx-4gw5-53pq applied in: helm-operator-fips 1.41.1-r0

Security vulnerability affects the helm-operator-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UV31886 Security fix for CVE-2024-31573 applied in: strimzi-kafka-operator 0.47.0-r2

Security vulnerability affects the strimzi-kafka-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YR80525 Security fix for CVE-2024-30171 applied in: strimzi-kafka-operator 0.47.0-r2

Security vulnerability affects the strimzi-kafka-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GK84785 Security fix for CVE-2024-29857 applied in: strimzi-kafka-operator 0.47.0-r2

Security vulnerability affects the strimzi-kafka-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-AT07752 Security fix for CVE-2024-29371 applied in: apache-nifi 2.6.0-r3, apache-nifi 2.7.2-r7, confluent-common-docker 7.6.9-r2, strimzi-kafka-operator 0.47.0-r2

CVE-2024-29371 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ML52514 Security fix for CVE-2022-42889 applied in: strimzi-kafka-operator 0.47.0-r2

Security vulnerability affects the strimzi-kafka-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TZ12135 Security fix for CVE-2024-26308 applied in: apache-hive 4.0.0-r1, spark-sc212-jdk17-py311 3.4.4-r0, spark-sc213-jdk17-py312 3.5.8-r0, strimzi-kafka-operator 0.47.0-r2

CVE-2024-26308 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HE16906 Security fix for CVE-2024-25710 applied in: apache-hive 4.0.0-r1, spark-sc212-jdk17-py311 3.4.4-r0, spark-sc213-jdk17-py312 3.5.8-r0, strimzi-kafka-operator 0.47.0-r2

CVE-2024-25710 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OJ21892 Security fix for CVE-2026-25518 applied in: cert-manager-cmctl-fips 2.4.0-r2, percona-xtradb-cluster-operator 1.18.0-r1, percona-xtradb-cluster-operator-fips 1.18.0-r1, step-issuer 0.9.11-r1

CVE-2026-25518 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...