CVE-2026-54297 vulnerabilities

Vulnerabilities for packages: cinc-auditor, gitlab-rails-ce, logstash, kube-fluentd-operator, gitlab-cng, logstash-fips, ruby3.3-faraday, kube-logging-operator, gitlab-rails-ce-fips...

GHSA-98M9-HRRM-R99R vulnerabilities

Vulnerabilities for packages: cinc-auditor, gitlab-rails-ce, logstash, kube-fluentd-operator, gitlab-cng, logstash-fips, ruby3.3-faraday, kube-logging-operator, gitlab-rails-ce-fips...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, helm-mapkubeapis, eksctl, kgateway-fips, neuvector, grype-fips, envoy-gateway-fips, helm-push, kubescape-operator, kaniko-fips, gitlab-rails-ce, helm-exporter-fips, docker-fips, consul-k8s, helm-operator-fips, google-osconfig-agent,...

GHSA-WJ3P-5H3X-C74Q vulnerabilities

Vulnerabilities for packages: backup-restore-operator, backup-restore-operator-fips...

CVE-2025-62879 vulnerabilities

Vulnerabilities for packages: backup-restore-operator, backup-restore-operator-fips...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: hubble-fips, kapp-controller-fips, azurefile-csi, cluster-api-aws-controller, rancher-system-agent, metrics-server-fips, kiali-fips, vitess, cluster-api, flux-image-automation-controller-fips, vault-fips, crossplane-provider-kubernetes, seaweedfs-operator-fips,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: hubble-fips, kapp-controller-fips, azurefile-csi, cluster-api-aws-controller, rancher-system-agent, metrics-server-fips, kiali-fips, vitess, cluster-api, flux-image-automation-controller-fips, vault-fips, crossplane-provider-kubernetes, seaweedfs-operator-fips,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, helm-mapkubeapis, eksctl, kgateway-fips, neuvector, grype-fips, envoy-gateway-fips, helm-push, kubescape-operator, kaniko-fips, gitlab-rails-ce, helm-exporter-fips, docker-fips, consul-k8s, helm-operator-fips, google-osconfig-agent,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, helm-mapkubeapis, eksctl, kgateway-fips, neuvector, grype-fips, envoy-gateway-fips, helm-push, kubescape-operator, kaniko-fips, gitlab-rails-ce, helm-exporter-fips, docker-fips, consul-k8s, helm-operator-fips, google-osconfig-agent,...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.3.2. Vulnerability Details CVEID:CVE-2026-27145 DESCRIPTION:x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused...

Important: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.4.1 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

EUVD-2026-38234

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54100 Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54100 Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

CVE-2026-54099 Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54099

The CVE-2026-54099 entry describes a vulnerability in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift. The WICD CSR auto-approver only checks that a CSR’s organization includes system:wicd-nodes and does not reject extra organization values such as system:masters. A compromised W...

CVE-2026-54099

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A...

CVE-2026-54100

A flaw was found in the Windows Machine Config Operator WMCO for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker who can intercept or redirect WMCO's SSH session can capture...

PT-2026-51305

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Container Platform 4 affected versions not specified Description A flaw exists in the Windows Machine Config Operator WMCO where the WICD CSR auto-approver validates that a Certificate Signing Request contains the organizatio...

CVE-2026-56325

Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for appid lookup in the preview subdomain resolver, allowing underscore characters in appid to act as SQL wildcards. Attackers can create apps with appids differing by one character at underscore positions to cause...