GO-2026-6163 vulnerabilities

Vulnerabilities for packages: op-geth, spegel-fips, ipfs-cluster, spegel, kubo, rke2-runtime, stunnerd, kubo-fips, k3s, rke2-runtime-fips, livekit-egress, ipfs-cluster-fips...

GO-2026-6099 vulnerabilities

Vulnerabilities for packages: spegel-fips, ipfs-cluster, spegel, kubo, rke2-runtime, k3s, rke2-runtime-fips, ipfs-cluster-fips...

GO-2026-6163 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, k3s, kubo, op-geth, spegel...

GO-2026-6099 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, k3s, spegel, kubo...

GO-2026-6165 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, k3s, kubo, spegel, telegraf...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: tekton-chains, telegraf, rke2-cloud-provider, yunikorn-k8shim, cert-manager, cluster-api-provider-vsphere, grafana, cloud-provider-aws, hubble-ui, kyverno-notation-aws, kube-metrics-adapter, kapp-controller, kubernetes-csi-external-health-monitor, cluster-api,...

EUVD-2026-62918

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

PT-2026-79122

Name of the Vulnerable Software and Affected Versions multicloud-operators-subscription affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a tenant with permissions to create HelmRelease custom resources CRs to bypass security controls. Th...

PT-2026-79098

Name of the Vulnerable Software and Affected Versions Submariner affected versions not specified Description A flaw allows a malicious spoke cluster to redirect network traffic from connected peer clusters by publishing a specially crafted network endpoint. The system does not properly validate...

PT-2026-79124

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a tenant with HelmRelease create permissions to manipulate the secretRef.Namespace field. This...

PT-2026-79099

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the lighthouse component occurs due to insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spok...

CVE-2026-73137: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

CVE-2026-66787: Active Debug Code

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

Virtuozzo Infrastructure 7.4 Hotfix 2 (7.4.0-80)

This update provides stability and security fixes. Vulnerability id: VSTOR-140619 A security fix for CVE-2026-64531. Vulnerability id: VSTOR-140678 A security fix for CVE-2026-64561. Vulnerability id: VSTOR-87519 Storage version bumping could remain disabled until the end of a cluster update,...

CVE-2026-76353

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

CVE-2026-76354

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer REST API request that deletes or temporarily overwrites files...

CVE-2026-76353

CVE-2026-76353 is a path traversal vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that knowledge bundle delta processing does not restrict removal paths to the staging directory, and the endpoint does not enforce the expected authorization...

CVE-2026-76348 Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege listsearchheadclustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a...

CVE-2026-76347 Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery SSRF in report notifications to send system-authenticated...

CVE-2026-76348

CVE-2026-76348 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The vulnerability resides in Search Head Cluster member control endpoints , which do not require a state-changing HTTP request type before applying read-only authorization. A user holding the high-privile...