SUSE CVE-2026-55884

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP server registers handlers on a gorilla/mux router with no authenticating middleware. When the HUD is bound to a non-loopback address, an unauthenticated network caller can...

EUVD-2026-51154

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CLEANSTART-2026-BZ74464 Security fixes in eks-distro-kube-apiserver-fips 1.34.2-r0

Package eks-distro-kube-apiserver-fips version 1.34.2-r0 fixes 32 vulnerabilities: ghsa-j5w8-q4qc-rx2x, ghsa-f6x5-jh6r-wrfv, CVE-2025-47911, CVE-2025-47913, CVE-2025-47914...

CLEANSTART-2026-JN50813 Security fixes in eks-distro-kube-apiserver 1.34.2-r0

Package eks-distro-kube-apiserver version 1.34.2-r0 fixes 21 vulnerabilities: ghsa-j5w8-q4qc-rx2x, ghsa-f6x5-jh6r-wrfv, CVE-2025-47911, CVE-2025-47913, CVE-2025-47914...

OPENSUSE-SU-2026:11388-1 kubernetes1.33-apiserver-1.33.13-2.1 on GA media

These are all security issues fixed in the kubernetes1.33-apiserver-1.33.13-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11391-1 kubernetes1.36-apiserver-1.36.3-1.1 on GA media

These are all security issues fixed in the kubernetes1.36-apiserver-1.36.3-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: flyway-fips, dependency-track, nacos, airbyte-server, guacamole-client, conductor-fips, floci, flyway, camunda-zeebe, druid, airbyte-server-fips, sonarqube, nuxeo, geoserver, kayenta, kayenta-fips, thingsboard, apicurio-registry, keycloak, request-9047-keycloak-fips,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: flyway-fips, dependency-track, nacos, airbyte-server, guacamole-client, conductor-fips, floci, flyway, camunda-zeebe, druid, airbyte-server-fips, sonarqube, nuxeo, geoserver, kayenta, kayenta-fips, thingsboard, apicurio-registry, keycloak, request-9047-keycloak-fips,...

CVE-2026-55882

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memor...

CVE-2026-55882 Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memor...

CVE-2026-10532 vulnerabilities

Vulnerabilities for packages: sonar-scanner-cli, localstack, apache-nifi-registry, s3proxy, nacos, airbyte-server, management-api-for-apache-cassandra-5.0, akhq, cassandra-reaper, cassandra-fips, kafbat-ui, management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-4.1,...

Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Servi...

Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Servi...

GHSA-C73Q-8XXR-RGQM Tilt: Missing authentication on the network-exposed Tilt HUD server

Summary The Tilt HUD HTTP server exposes state-changing and sensitive-read endpoints with no authentication. When the HUD is bound to a non-loopback address, a network attacker can trigger the developer's pre-defined Tiltfile resources, tamper with Tiltfile arguments, read full engine state...

Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server

Summary The Tilt HUD server mounts Go's net/http/pprof handlers under /debug with no access control. When the HUD is network-exposed, an attacker can read process memory — including session and apiserver tokens — and hold the process under profiling. Details A blank import of net/http/pprof...

PT-2026-50978

Name of the Vulnerable Software and Affected Versions Tilt versions 0.19.5 through 0.37.3 Description The Tilt HUD server mounts Go's net/http/pprof handlers under the '/debug' endpoint without access control. When the HUD is network-exposed, an unauthenticated caller can read process memory via...

PT-2026-50980

Name of the Vulnerable Software and Affected Versions Tilt versions 0.20.8 through 0.37.3 Description The HUD HTTP server lacks authentication for state-changing and sensitive-read endpoints. When the HUD is bound to a non-loopback address, a network attacker can trigger pre-defined Tiltfile...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.65 security and extras update

Red Hat OpenShift Container Platform release 4.15.65 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.42 security and extras update

Red Hat OpenShift Container Platform release 4.18.42 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...

CVE-2026-42198 vulnerabilities

Vulnerabilities for packages: debezium, flyway-fips, dependency-track, nacos, guacamole-client, flyway, apache-hop, camunda-zeebe, druid, sonarqube, nuxeo, geoserver, kayenta, kayenta-fips, thingsboard, apicurio-registry, keycloak, camunda, hono, apache-hop-fips, ghidra, keycloak-fips, seata,...