IBM Licensing Operator Elevation of Privilege Vulnerability

IBM Licensing Operator is a component of International Business Machines IBM that automates the collection of management data. An elevation of privilege vulnerability exists in IBM Licensing Operator that can be exploited by an attacker to cause a local elevation of privilege within a container...

CVE-2026-1588 jishenghua jshERP installByPath install path traversal

A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It...

CVE-2026-1588

A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It...

EUVD-2026-4999

A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It...

CVE-2026-1588 jishenghua jshERP installByPath install path traversal

A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It...

PT-2026-5265

A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It...

Qualcomm embedded firmware DoS

The vulnerability of WLAN microprogramming software in Qualcomm embedded chips lies in the use of the assert or similar operator. Exploiting this vulnerability allows a malicious actor to cause a service failure when processing a specially crafted ANQP message...

GHSA-4XH5-JCJ2-CH8Q vulnerabilities

Vulnerabilities for packages: flux-operator...

CVE-2026-23990 vulnerabilities

Vulnerabilities for packages: flux-operator...

GHSA-4XH5-JCJ2-CH8Q vulnerabilities

Vulnerabilities for packages: flux-operator, flux-operator-fips...

CVE-2026-23990 vulnerabilities

Vulnerabilities for packages: flux-operator, flux-operator-fips...

GHSA-JQC5-W2XX-5VQ4 vulnerabilities

Vulnerabilities for packages: tflint-fips, crossplane, sigstore-scaffolding, spire-server-fips, cosign, tkn-fips, tflint, flux-source-controller, kubescape, buildkitd, trivy-operator, tkn, trivy-operator-fips, ko, cosign-fips, spire-server, tekton-chains, zot, kyverno-fips, image-factory, gitsign...

CVE-2026-24686 vulnerabilities

Vulnerabilities for packages: tflint-fips, crossplane, sigstore-scaffolding, spire-server-fips, cosign, tkn-fips, tflint, flux-source-controller, kubescape, buildkitd, trivy-operator, tkn, trivy-operator-fips, ko, cosign-fips, spire-server, tekton-chains, zot, kyverno-fips, image-factory, gitsign...

CVE-2026-24116 Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the f64.copysign WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are...

Who Operates the Badbox 2.0 Botnet?

The cybercriminals in control of Kimwolf -- a disruptive botnet that has infected more than 2 million devices -- recently shared a screenshot indicating they'd compromised the control panel for Badbox 2.0 , a vast China-based botnet powered by malicious software that comes pre-installed on many...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1

cert-manager Operator for Red Hat OpenShift 1.18.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1

cert-manager Operator for Red Hat OpenShift 1.18.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1

cert-manager Operator for Red Hat OpenShift 1.18.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.0

The 1.21.0 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.21.0 release of Red Hat OpenShift Pipelines Operator...