CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: migrate, kbld, harbor-cli, oauth2-proxy, terraform-provider-tls, php-fpmexporter, spire-server, timestamp-authority, envoy-gateway, terraform-provider-time, grpc-health-probe, logstash-exporter, dapr, rabbitmq-messaging-topology-operator, maru, dgraph, go-licenses,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: kube-arangodb-fips, envoy-gateway, harbor-fips, helm-operator, flux, tigera-operator-fips, cerbos-fips, chart-testing, tw, kube-arangodb, cluster-api-helm-controller-fips, envoy-gateway-fips, chaos-mesh-fips, consul-k8s, helm-set-status, pluto-fips, flux-fips, k8sgpt...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: buildah-fips, policy-controller, amazon-ecs-agent-fips, flux-fips, go, influxd, amazon-ecs-cni-plugins, nats, loki, falcoctl-fips, kyverno, external-dns, dex, jsonnet-bundler, gh, flux-source-controller, goreleaser, incert, gitlab-kas-fips, grafana,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: buildah-fips, policy-controller, amazon-ecs-agent-fips, flux-fips, go, influxd, amazon-ecs-cni-plugins, nats, loki, falcoctl-fips, kyverno, external-dns, dex, jsonnet-bundler, gh, flux-source-controller, goreleaser, incert, gitlab-kas-fips, grafana,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: wait-for-port, influxd, loki, falco-exporter, ceph-csi-operator-fips, emissary, flux-source-controller, victoriametrics-fips, amass, crossplane-function-environment-configs, knative-serving, crossplane-provider-aws-rolesanywhere-fips, kubescape-http-request-fips, zot...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: buildah-fips, prometheus-elasticsearch-exporter-fips, kubernetes-csi-livenessprobe, cilium-certgen, kyverno-policy-reporter-plugins-kyverno, aws-fsx-csi-driver-fips, amazon-ecs-agent-fips, policy-controller, kapp, flux-fips, go, crossplane-provider-aws-kinesis-fips,...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the AdminService/StreamWorkflowReplicationMessages endpoint. An attacker can access replication streams and exfiltrate data by connecting to the frontend gRPC server without providing...

EUVD-2026-21607

The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests...

CVE-2026-5724

The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests...

EUVD-2026-20876

LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin...

GHSA-C3H3-89QF-JQM5 LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

Summary A restricted TLS certificate user can escalate to cluster admin by changing their certificate type from client to server via PUT/PATCH to /1.0/certificates/fingerprint. The non-admin guard and reset block in doCertificateUpdate fail to validate or reset the Type field, allowing a...

LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

Summary A restricted TLS certificate user can escalate to cluster admin by changing their certificate type from client to server via PUT/PATCH to /1.0/certificates/fingerprint. The non-admin guard and reset block in doCertificateUpdate fail to validate or reset the Type field, allowing a...

GHSA-99J8-WV67-4C72 Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

Impact A developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its ClusterRole and write...

EUVD-2026-20965

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource...

Discourse Information Disclosure Vulnerability (CNVD-2026-17250)

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse has an information leakage vulnerability , the vulnerability stems from the discourse-subscriptions plugin leaks stripe API key...

CVE-2026-39961 Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys...

CVE-2026-39961 Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys...

DEBIAN-CVE-2026-34179

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/fingerprint for restricted TLS certificate users, allowing a remote authenticated attacker to escalate...

CVE-2026-34179

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/fingerprint for restricted TLS certificate users, allowing a remote authenticated attacker to escalate...

CVE-2026-34179

In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/fingerprint for restricted TLS certificate users, allowing a remote authenticated attacker to escalate...