Moderate: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

Important: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

CVE-2026-55539: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...

PT-2026-81348

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The Jobs API in PraisonAI lacks authentication middleware, router-level dependencies, and per-route authorization checks. This allows any caller who can reach the jobs server to submit agent jobs...

EUVD-2026-64888

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: The correct message length must be passed to ip6.AppendData. l2tpip6sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To address this issu...

CVE-2026-78155

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

CVE-2026-78155 Untrusted Search Path in StackGres

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

CVE-2026-78155 Untrusted Search Path in StackGres

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

CVE-2026-78155 Untrusted Search Path in StackGres

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

EUVD-2026-64648

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

CVE-2026-78155

CVE-2026-78155 is a critical untrusted search path vulnerability in the StackGres operator that enables privilege escalation . A low-privilege tenant who owns a database can exploit this flaw to gain administrator privileges . The CVSS 3.1 score is 9.9 (Critical) with a network attack vector, low...

PT-2026-79767

Name of the Vulnerable Software and Affected Versions StackGres versions prior to 1.18.9 Description A privilege escalation issue exists in the StackGres operator, which is used to deploy and manage PostgreSQL clusters on Kubernetes. A low-privilege tenant who owns a database can bypass isolation...

CVE-2026-78155: Untrusted Search Path

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

gcc: libstdc++ integer overflow in `new` operator

A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability...

Use of Incorrect Operator

Overview Affected versions of this package are vulnerable to Use of Incorrect Operator via the take parameter in GraphQL queries. An attacker can cause excessive resource consumption by supplying negative values to bypass intended query limits. Workaround This vulnerability can be mitigated by...

renovate-operator v6.0.1

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object e.g. "$gt": "4" can be substituted for ...

CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object e.g. "$gt": "4" can be substituted for ...

Linux Distros Unpatched Vulnerability : CVE-2022-4996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with...