EUVD-2026-60951

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...

CVE-2026-66793

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...

GO-2026-6157 Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) in github.com/projectcapsule/capsule

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation cross-tenant privilege escalation in github.com/projectcapsule/capsule...

GO-2026-6160 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook...

GO-2026-6105 Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources in github.com/zxh326/kite

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources in github.com/zxh326/kite...

CVE-2026-75839

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839

ArcadeDB versions ≤ 26.7.3 expose an IDOR in the Raft cluster-info endpoints (GetClusterHandler, PostBootstrapStateHandler): authenticated users lacking cross-database privileges can enumerate the server's full database registry and retrieve per-database metadata (names, transaction IDs, bootstra...

EUVD-2026-60603

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75839 ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-66783: Reliance on Insufficiently Trustworthy Component

A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource CR, to specify an unvalidated image path. This lack of validation...

PT-2026-77723

Name of the Vulnerable Software and Affected Versions MySQL Cluster versions 8.0.0 through 8.0.48 MySQL Cluster versions 8.4.0 through 8.4.11 MySQL Cluster versions 9.7.0 through 9.7.2 Description An unauthenticated attacker with network access via HTTP can compromise the MySQL Cluster. This issu...

PT-2026-77226

Name of the Vulnerable Software and Affected Versions Submariner operator affected versions not specified Description A flaw in the Submariner operator allows a long-lived broker service account SA bearer token to be exposed within the Submariner Custom Resource CR specification. An attacker with...

PT-2026-77251

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Description An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate...

CVE-2026-74044: Improper Limitation of a Pathname to a Restricted Directory

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

PT-2026-77227

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the submariner-operator component allows a cluster administrator or any user with permissions to modify the Submariner Custom Resource CR ...

CVE-2026-70717: Improper Access Control

Vulnerability in Oracle Autonomous Health Framework component: Cluster Health Analyzer. Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attach...

CVE-2026-75485: Insertion of Sensitive Information into Log File

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...