CVE-2026-32992: Improper Certificate Validation

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials...

RHEL 10 : fence-agents (RHSA-2026:17083)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17083 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or...

CVE-2026-44015

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CVE-2026-44015

CVE-2026-44015 describes SSRF in Nginx UI prior to 2.3.5 where an authenticated user can create a cluster node with an internal URL and trigger the Proxy middleware to forward requests using the X-Node-ID header, bypassing network segmentation and reaching localhost/internal services (including c...

CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CVE-2026-42541 Kubewarden: RBAC Reconnaissance via unchecked can_i host capability call

Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions which isn't the default can craft a policy that makes use of the cani host callback. The callback issues a SubjectAccessReview SAR requests to enumerate...

Nginx UI code-related vulnerabilities

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI 2.3.4 and earlier have code vulnerabilities. This vulnerability allows authenticated users to create cluster nodes that point to arbitrary internal URLs and send API requests with the X-Node-ID header, resulting in SSR...

Google Cloud AlloyDB for PostgreSQL security vulnerabilities

Google Cloud AlloyDB for PostgreSQL is a cloud-native, high-performance relational database service from Google Inc. That service is compatible with PostgreSQL. Versions of Google Cloud AlloyDB for PostgreSQL prior to 2025-11-03 contained a security vulnerability. This vulnerability stemmed from...

CVE-2026-42600

Summary of the vulnerability (CVE-2026-42600) : MinIO’s ReadMultiple internode storage-REST endpoint is vulnerable to path traversal when processing a msgpack-encoded ReadMultipleReq body. An attacker holding the cluster root JWT can craft a request to POST /minio/storage/{drivePath}/v63/rmpl wit...

CVE-2026-42600: Improper Limitation of a Pathname to a Restricted Directory

MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configure...

MinIO path traversal vulnerability

MinIO is an open-source object storage server developed by the American company MinIO. This product supports the creation of infrastructures for machine learning, analysis, and application data workloads. Versions of MinIO from RELEASE.2022-07-24T01-54-52Z to RELEASE.2026-04-14T21-32-45Z had a pa...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-017453)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017453 advisory. Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior,...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-017456)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017456 advisory. Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.26 and prior. Difficult to explo...

CVE-2026-39825 vulnerabilities

Vulnerabilities for packages: libnvidia-container, argo-cd, k3s, k8s-device-plugin, cilium-cli, kubevela, kube-fluentd-operator, prometheus, telegraf, runc, karpenter, dask-gateway, zarf, helm, falco-no-driver, mattermost, aactl, aws-flb-firehose, flux, zot, nerdctl, kubo, kaf,...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: libnvidia-container, argo-cd, k3s, k8s-device-plugin, cilium-cli, kubevela, kube-fluentd-operator, prometheus, telegraf, runc, karpenter, dask-gateway, zarf, helm, falco-no-driver, mattermost, aactl, aws-flb-firehose, flux, zot, nerdctl, kubo, kaf,...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: karpenter-fips, istio-fips, commercial-chainloop-cli, tekton-pipelines, zarf, containerd, rancher-agent, cloud-provider-azure-fips, commercial-expanso-edge, redka, nerdctl, kube-conformance, kuma, longhorn-manager-fips, k3s, prometheus-mongodb-exporter, authentik-fip...

CVE-2026-39825 vulnerabilities

Vulnerabilities for packages: karpenter-fips, istio-fips, commercial-chainloop-cli, tekton-pipelines, zarf, containerd, rancher-agent, cloud-provider-azure-fips, commercial-expanso-edge, redka, nerdctl, kube-conformance, kuma, longhorn-manager-fips, k3s, prometheus-mongodb-exporter, authentik-fip...

CVE-2026-42499 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-guardduty, mcp-grafana-fips, kueue-fips, crossplane-provider-aws-acm-fips, openbao-fips, zarf, crossplane-provider-aws-opensearch-fips, cloud-provider-azure-fips, crossplane-provider-aws-route53resolver-fips, nerdctl, cass-operator-fips,...