CVE-2026-27199 vulnerabilities

Vulnerabilities for packages: superset, kubeflow-volumes-web-app, emissary, mlflow, kubeflow-pipelines-visualization-server, open-webui, airflow...

GHSA-29VQ-49WR-VM6X vulnerabilities

Vulnerabilities for packages: superset, kubeflow-volumes-web-app, emissary, mlflow, kubeflow-pipelines-visualization-server, open-webui, airflow...

CVE-2026-27205 vulnerabilities

Vulnerabilities for packages: mitmproxy, kubeflow-volumes-web-app, emissary, mlflow, open-webui, airflow...

GHSA-68RP-WP8R-4726 vulnerabilities

Vulnerabilities for packages: mitmproxy, kubeflow-volumes-web-app, emissary, mlflow, open-webui, airflow...

GHSA-68RP-WP8R-4726 vulnerabilities

Vulnerabilities for packages: airflow-core, emissary, open-webui, kubeflow-volumes-web-app, mlflow, mitmproxy, airflow...

CVE-2026-27205 vulnerabilities

Vulnerabilities for packages: airflow-core, emissary, open-webui, kubeflow-volumes-web-app, mlflow, mitmproxy, airflow...

CVE-2026-27199 vulnerabilities

Vulnerabilities for packages: airflow-core, azure-functions-python-worker, superset, emissary, tensorflow-cpu-jupyter, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, litellm, localstack, mlflow, open-webui, tensorflow-gpu-jupyter, airflow...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

GHSA-FXP3-G6GW-4R4V Craft CMS: GraphQL Asset Mutation Privilege Escalation

There is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not...

CVE-2026-25497

Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their...

CVE-2026-25497 Craft has a GraphQL Asset Mutation Privilege Escalation

Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their...

Moderate: Red Hat Security Advisory: VolSync v0.13 security fixes and container updates

VolSync v0.13 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

Impact A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories. Example: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata:...

GHSA-JR3W-9VFR-C746 Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

Impact A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories. Example: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata:...

AZL-75446 CVE-2025-14459 affecting package kubevirt 1.7.0-3

A flaw was found in KubeVirt Containerized Data Importer CDI. This vulnerability allows a user to clone PersistentVolumeClaims PVCs from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004332)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004332 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in btrfsmapblock in...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004116)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004116 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in btrfsmapblock in...

Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE

Summary Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitizati...

GHSA-GJQQ-6R35-W3R8 Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE

Summary Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitizati...