1573 matches found
CVE-2026-18544 Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference
IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...
CVE-2026-18544: Missing Authorization
IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...
PT-2026-78689
Name of the Vulnerable Software and Affected Versions IBM Portieris versions 0.5.0 through 0.14.2 Description Improper authorization of pod owner references allows a remote authenticated attacker to bypass image policy enforcement. Recommendations Update IBM Portieris to a version later than 0.14...
CVE-2026-47699 Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback
Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...
CVE-2026-61302
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Pod Admin. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...
EUVD-2026-61362
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Pod Admin. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...
GO-2026-6143 netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil
netfoil: Incorrect block responses could lead to localhost traffic in github.com/tinfoil-factory/netfoil...
CVE-2026-61302: Improper Access Control
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Pod Admin. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...
CVE-2026-75924: Improper Privilege Management
A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...
PT-2026-77518
Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0.0 Description An issue in the Pod Admin component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...
CVE-2026-71472 Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...
CVE-2026-71472
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...
CVE-2026-71472
The flaw resides in postgresql-start.sh within the search-v2-operator of acm-search-v2-rhel9. The WORK_MEM string supplied via a Search Custom Resource is passed unvalidated into both a bash script and an SQL query, enabling authenticated hub administrators or CR editors to inject shell commands ...
EUVD-2026-60362
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...
CVE-2026-71472
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...
PT-2026-76763
Name of the Vulnerable Software and Affected Versions acm-search-v2-rhel9 affected versions not specified Description An authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, can inject malicious shell commands or SQL statements. This issue exists because the...
GO-2026-4316 vulnerabilities
Vulnerabilities for packages: commercial-kyverno, aws-lambda-runtime-interface-emulator-fips, custom-pod-autoscaler, custom-pod-autoscaler-fips, cloudbeat, cloudbeat-fips, fleet-server-fips, aws-lambda-runtime-interface-emulator, kyverno-fips...
GO-2024-3106 vulnerabilities
Vulnerabilities for packages: mc-fips, kustomize-fips, opa-fips, pulumi-language-java, docker-credential-acr-env, k3d, addon-resizer-fips, prometheus-pushgateway, gptscript, sbom-scorecard, flux-source-controller, nri-apache, kube-vip-fips, kube-logging-logging-operator, go, chezmoi,...
