curl: GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)

Summary This report describes a variant of the publicly disclosed curl vulnerability CVE-2020-8286 OCSP stapling verification bypass, found in the GnuTLS TLS backend lib/vtls/gtls.c. The original CVE affected the NSS backend; this variant reproduces the same logical class of defect — accepting...

OESA-2026-2561 glib-networking security update

glib-networking contains the implementations of certain GLib networking features that cannot be implemented directly in GLib itself because of their dependencies. Security Fixes: A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafte...

[SECURITY] Fedora 44 Update: rust-sequoia-cert-store-0.7.3-1.fc44

A certificate database interface...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: nova, authservice, nfs-subdir-external-provisioner, crossplane-provider-azure-storage, gitlab-runner, dgraph, vcluster, crossplane-provider-aws-kinesis, telegraf, apisix-ingress-controller, addon-resizer, flyte, jaeger-operator, grafana,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: nova, authservice, nfs-subdir-external-provisioner, crossplane-provider-azure-storage, gitlab-runner, dgraph, vcluster, crossplane-provider-aws-kinesis, telegraf, apisix-ingress-controller, addon-resizer, flyte, jaeger-operator, grafana,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: nova, nri-consul, authservice, nfs-subdir-external-provisioner, crossplane-provider-azure-storage, conjur-cli, gitlab-runner, atlantis, dgraph, gomplate, sftpgo-plugin-auth, vcluster, crossplane-provider-aws-kinesis, telegraf, tetragon, apisix-ingress-controller,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: nova, nri-consul, authservice, nfs-subdir-external-provisioner, crossplane-provider-azure-storage, conjur-cli, gitlab-runner, atlantis, dgraph, gomplate, sftpgo-plugin-auth, vcluster, crossplane-provider-aws-kinesis, telegraf, tetragon, apisix-ingress-controller,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: nova, nri-consul, authservice, nfs-subdir-external-provisioner, crossplane-provider-azure-storage, conjur-cli, gitlab-runner, atlantis, dgraph, gomplate, sftpgo-plugin-auth, vcluster, crossplane-provider-aws-kinesis, telegraf, tetragon, apisix-ingress-controller,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: nova, nri-consul, authservice, nfs-subdir-external-provisioner, crossplane-provider-azure-storage, conjur-cli, gitlab-runner, atlantis, dgraph, gomplate, sftpgo-plugin-auth, vcluster, crossplane-provider-aws-kinesis, telegraf, tetragon, apisix-ingress-controller,...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, kubeflow-pipelines, crossplane-provider-aws-servicediscovery, prometheus-fips, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, redka, crossplane-provider-azure-portal, nfs-subdir-external-provisioner,...

CVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840

CVE-2026-10840 concerns the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role. When Kueue or cert-manager CRDs are present, any authenticated...

CVE-2026-10840 Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

EUVD-2026-34248

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

CVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...