GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: terraform-provider-databricks-fips, podman, packer, amazon-eks-ami, crossplane-provider-aws-kinesis-fips, cloud-provider-gcp-cloud-controller-manager-fips, prometheus-podman-exporter-fips, promxy-fips, ld-relay-fips, weaviate, commercial-expanso-edge, containerd,...

CLEANSTART-2026-MO16862 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-pjcq-xvwq-hhpj applied in versions: 1.20.2-r0

Multiple security vulnerabilities affect the cert-manager package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-33814 affecting package cert-manager for versions less than 1.12.15-9

CVE-2026-33814 affecting package cert-manager for versions less than 1.12.15-9. A patched version of the package is available...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, prometheus, vcluster, authservice, kubescape-operator, hubble, fuse-overlayfs-snapshotter, crossplane-provider-aws-ec2, rancher, cert-manager, docker-cli-buildx, mattermost, mountpoint-s3-csi-driver, rook, kiali, jaeger-operator,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, prometheus, vcluster, authservice, kubescape-operator, hubble, fuse-overlayfs-snapshotter, crossplane-provider-aws-ec2, rancher, cert-manager, docker-cli-buildx, mattermost, mountpoint-s3-csi-driver, rook, kiali, jaeger-operator,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, prometheus, guac, vcluster, apache-exporter, authservice, gogatekeeper, step-ca, kubescape-operator, hubble, neuvector-dbgen, fuse-overlayfs-snapshotter, conjur-cli, spqr, neuvector-scanner, crossplane-provider-aws-ec2, rancher, bank-vaults...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, prometheus, guac, vcluster, apache-exporter, authservice, gogatekeeper, step-ca, kubescape-operator, hubble, neuvector-dbgen, fuse-overlayfs-snapshotter, conjur-cli, spqr, neuvector-scanner, crossplane-provider-aws-ec2, nri-redis,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, prometheus, guac, vcluster, apache-exporter, authservice, gogatekeeper, step-ca, kubescape-operator, hubble, neuvector-dbgen, fuse-overlayfs-snapshotter, conjur-cli, spqr, neuvector-scanner, crossplane-provider-aws-ec2, rancher, bank-vaults...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: external-secrets-operator, prometheus, guac, vcluster, apache-exporter, authservice, gogatekeeper, step-ca, kubescape-operator, hubble, neuvector-dbgen, fuse-overlayfs-snapshotter, conjur-cli, spqr, neuvector-scanner, crossplane-provider-aws-ec2, nri-redis,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: crossplane-aws-provider-fips, cloud-provider-gcp-cloud-controller-manager-fips, promxy-fips, kubevirt-cdi-apiserver-fips, listmonk, commercial-expanso-edge, containerd, kubevela-fips, step-issuer, crossplane-provider-aws-datasync,...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: crossplane-aws-provider-fips, cloud-provider-gcp-cloud-controller-manager-fips, promxy-fips, kubevirt-cdi-apiserver-fips, listmonk, commercial-expanso-edge, containerd, kubevela-fips, step-issuer, crossplane-provider-aws-datasync,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: crossplane-aws-provider-fips, prometheus-mongodb-exporter-fips, amazon-eks-ami, cloud-provider-gcp-cloud-controller-manager-fips, prometheus-podman-exporter-fips, promxy-fips, ld-relay-fips, kubevirt-cdi-apiserver-fips, listmonk, terrafmt, commercial-expanso-edge,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: crossplane-aws-provider-fips, prometheus-mongodb-exporter-fips, amazon-eks-ami, cloud-provider-gcp-cloud-controller-manager-fips, prometheus-podman-exporter-fips, promxy-fips, ld-relay-fips, kubevirt-cdi-apiserver-fips, listmonk, terrafmt, commercial-expanso-edge,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: crossplane-aws-provider-fips, prometheus-mongodb-exporter-fips, amazon-eks-ami, cloud-provider-gcp-cloud-controller-manager-fips, prometheus-podman-exporter-fips, promxy-fips, ld-relay-fips, kubevirt-cdi-apiserver-fips, listmonk, terrafmt, commercial-expanso-edge,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: crossplane-aws-provider-fips, prometheus-mongodb-exporter-fips, amazon-eks-ami, cloud-provider-gcp-cloud-controller-manager-fips, prometheus-podman-exporter-fips, promxy-fips, ld-relay-fips, kubevirt-cdi-apiserver-fips, listmonk, terrafmt, commercial-expanso-edge,...

CVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840

CVE-2026-10840 concerns the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role. When Kueue or cert-manager CRDs are present, any authenticated...

EUVD-2026-34248

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840 Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...