Cisco Meeting Management Arbitrary File Upload Vulnerability

A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system. This vulnerability is due to improper input validation in...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-manager-csi-driver, percona-server-mongodb-operator, mariadb-operator, step-issuer, cert-manager-cmctl, opentelemetry-operator...

CVE-2026-20098: Unrestricted Upload of File with Dangerous Type

A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system. This vulnerability is due to improper input validation in...

GO-2026-4330 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-istio-csr, cert-manager-csi-driver, percona-server-mongodb-operator, mariadb-operator, step-issuer, cert-manager-cmctl, opentelemetry-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-istio-csr, gitlab-operator, cert-manager-google-cas-issuer, step-issuer, mariadb-operator-fips, cert-manager-istio-csr-fips, cert-manager-csi-driver-fips, step-issuer-fips, cert-manager-webhook-pdns-fips,...

CVE-2026-25233 PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0...

CVE-2026-25233 PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0...

CVE-2026-25233 PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0...

Important: Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update

An updated OpenShift Compliance Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift Compliance Operator v1.8.2 is now available. See the documentation for bug fix information:...

Malicious code in transform-exponentiation-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b79481ce559cb600cfe4b2897847eb06d38b5cbe4ef456339cbbac7b240e60 The package transform-exponentiation-operator was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview transform-exponentiation-operator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

MAL-2026-665 Malicious code in transform-exponentiation-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b79481ce559cb600cfe4b2897847eb06d38b5cbe4ef456339cbbac7b240e60 The package transform-exponentiation-operator was found to contain malicious code. Source: ghsa-malware...

Malware in transform-exponentiation-operator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2026-6506

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function in github.com/external-secrets/external-secrets...

GO-2026-4351 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator...

CVE-2025-61728 vulnerabilities

Vulnerabilities for packages: eksctl, goreleaser, falco-no-driver, thanos-operator, headlamp, kubernetes-dashboard, helm-operator, helm-set-status, kubernetes-dashboard-api, ingress-nginx-controller, kubernetes-dns-node-cache, nerdctl, k8sgateway, cilium-cli, steampipe, kine, runc,...

GHSA-G9Q4-QJX4-2V7Q vulnerabilities

Vulnerabilities for packages: eksctl, goreleaser, falco-no-driver, thanos-operator, headlamp, kubernetes-dashboard, helm-operator, helm-set-status, kubernetes-dashboard-api, ingress-nginx-controller, kubernetes-dns-node-cache, nerdctl, k8sgateway, cilium-cli, steampipe, kine, runc,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: eksctl, goreleaser, rancher-machine, cert-manager-istio-csr, rancher-system-upgrade-controller, thanos-operator, extism, git-lfs, crossplane-provider-azure-sql, nerdctl, k8sgateway, cluster-api-gcp-controller, kine, docker-credential-gcr, azcopy, ghaudit,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: goreleaser, cert-manager-istio-csr, thanos-operator, extism, nerdctl, sbom-convert, docker-credential-gcr, fixuid, azcopy, ghaudit, terraform-provider-pagerduty, nri-nginx, yunikorn-k8shim, percona-server-mongodb-operator, ipfs-cluster, go-md2man,...