GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, crossplane-provider-azure-solutions, gitlab-pages, steampipe, agentbeat, prometheus-mongodb-exporter, crossplane-provider-aws-lexmodels-fips, mapotf, flux-kustomize-controller, crossplane-fips, crossplane-provider-aws-guardduty,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: knative-serving-fips, longhorn-cli-fips, gitlab-runner, gatekeeper, flux-image-automation-controller-fips, prometheus-mongodb-exporter, opentelemetry-collector, mapotf, mattermost, argo-workflows, gitlab-rails-ce-fips, rancher-agent, etcd-fips, spire-server,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: openbao, grype, splunk-otel-collector, vault-benchmark, docker-compose, traefik, go-discover, terraform-provider-azurerm, sops, crossplane-provider-aws-iam, kine, external-secrets-operator, kubernetes, external-dns, prometheus, crossplane-provider-family-azure,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: openbao, grype, splunk-otel-collector, vault-benchmark, go-discover, terraform-provider-azurerm, sops, kine, external-secrets-operator, kubernetes, external-dns, prometheus, crossplane-provider-family-azure, opentofu, argocd-image-updater, melange, gptscript, mods,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: trivy-operator, kots, snyk-cli, gitea, kyverno, trivy, kubernetes-dashboard, spire-server, flux-source-controller, flux-image-automation-controller, kine, cert-manager, external-secrets-operator, cloud-provider-aws, flux, minio, zarf, kubernetes, external-dns,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: openbao, grype, splunk-otel-collector, vault-benchmark, docker-compose, traefik, go-discover, terraform-provider-azurerm, sops, crossplane-provider-aws-iam, kine, external-secrets-operator, kubernetes, external-dns, prometheus, crossplane-provider-family-azure,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: kots, snyk-cli, kyverno, kubernetes-dashboard, spire-server, kine, cert-manager, external-secrets-operator, cloud-provider-aws, flux, minio, kubernetes, external-dns, prometheus, mattermost, podman, k3s, containerd, fscrypt, gitlab-kas, helm, kaf, prometheus-operator...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

EUVD-2026-39794

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

CVE-2026-9640

CVE-2026-9640 concerns LXD versions 6.0–6.9, 5.21.0–5.21.5, and 5.0.0–5.0.7. It describes a privilege escalation where an authenticated project operator in a restricted multi-tenant environment can bypass project-restriction policies during snapshot restoration by importing a malicious instance b...

CVE-2026-9640 LXD Snapshot Import Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

PT-2026-52844

Name of the Vulnerable Software and Affected Versions LXD versions 6.0 through 6.8 LXD versions 5.21.0 through 5.21.4 LXD versions 5.0.0 through 5.0.6 Description An issue exists in the handling of project-restriction policies during snapshot restoration. An authenticated project operator in a...

PT-2026-53025

Summary js-toml's interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is skipped and the value is silently overwritten by a...

PT-2026-53022

Name of the Vulnerable Software and Affected Versions Nebula Mesh affected versions not specified Description The web UI /ui/ fails to apply per-operator Certificate Authority CA scoping. This allows any authenticated non-admin operator to access, block, or delete resources belonging to other...

CVE-2026-47770

A flaw was found in jq, a command-line JSON processor. This vulnerability allows a local user or an attacker providing malicious input to cause a denial of service DoS by comparing two sufficiently deeply nested arrays using the '==' operator. This action exhausts the C stack due to uncontrolled...

GO-2026-5631 k8sGPT has Prompt Injection through its k8sGPT-Operator in github.com/k8sgpt-ai/k8sgpt

k8sGPT has Prompt Injection through its k8sGPT-Operator in github.com/k8sgpt-ai/k8sgpt...

GO-2026-5723 External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets

External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore in github.com/external-secrets/external-secrets. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions...