CVE-2026-53576

Kestra prior to versions 1.0.45 and 1.3.21 contained an authentication filter bypass on the REST API. Requests whose path ends in /configs were treated as the public instance-config endpoint and forwarded without credential checks, allowing anonymous access to resources such as /api/v1/{tenant}/f...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: tflint-fips, tflint, tekton-chains, aactl, falcoctl-fips, docker-fips, ko-fips, zarf, crossplane, ratify, falcoctl, policy-controller-fips, kubescape, chainctl-fips, policy-controller, kyverno-fips, cloudbeat-fips, tkn, cloudbeat, tbot, tekton-chains-fips, tkn-fips,...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: tflint-fips, tflint, tekton-chains, aactl, falcoctl-fips, docker-fips, ko-fips, zarf, crossplane, ratify, falcoctl, policy-controller-fips, kubescape, chainctl-fips, policy-controller, kyverno-fips, cloudbeat-fips, tkn, cloudbeat, tbot, tekton-chains-fips, tkn-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: skaffold, coder-fips, etcd, snyk-cli, flux-source-controller-fips, flux-source-controller, elastic-agent-fips, containerd, frankenphp-8.3, fscrypt, kine, terraform, mattermost-fips, nerdctl, seaweedfs-rocksdb-fips, external-dns, gitlab-kas, reports-server,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: grype-fips, skaffold, witness, coder-fips, etcd, rootlesskit-fips, wal-g, juicefs, peerdb-flow, snyk-cli, flux-source-controller-fips, flux-source-controller, pulumi-language-java, elastic-agent-fips, containerd, frankenphp-8.3, fscrypt, kine, terraform,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: step, external-secrets-fips, peerdb-flow, flux-source-controller-fips, crossplane-provider-azure-synapse, docker-compose-fips, kueue-fips, fscrypt, syft-fips, crossplane-provider-aws-emr, nerdctl, step-kms-plugin, crossplane-provider-aws-route53,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: step, external-secrets-fips, peerdb-flow, flux-source-controller-fips, crossplane-provider-azure-synapse, docker-compose-fips, kueue-fips, fscrypt, syft-fips, crossplane-provider-aws-emr, nerdctl, step-kms-plugin, crossplane-provider-aws-route53,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: etcd, snyk-cli, elastic-agent-fips, containerd, frankenphp-8.3, fscrypt, kine, terraform, mattermost-fips, nerdctl, podman, external-dns, gitlab-kas, reports-server, omnictl-multiarch-fips, tigera-operator, traefik, harbor, argo-workflows, teleport-operator-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: cert-manager, cosign, rootlesskit, external-dns, grype, eksctl, kubernetes, openbao, zot, gitea, pulumi-language-dotnet, tekton-chains, k3s, docker-machine-driver-harvester, syft, gomplate, spire-server, cilium-cli, crossplane-provider-azure-authorization,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: cert-manager, cosign, rootlesskit, external-dns, grype, eksctl, kubernetes, openbao, zot, gitea, pulumi-language-dotnet, tekton-chains, k3s, docker-machine-driver-harvester, syft, gomplate, spire-server, cilium-cli, crossplane-provider-azure-authorization,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: cert-manager, rootlesskit, external-dns, grype, kubernetes, zot, gitea, pulumi-language-dotnet, k3s, docker-machine-driver-harvester, syft, gomplate, spire-server, cilium-cli, opentofu, terragrunt, splunk-otel-collector, trivy-operator, nerdctl, minio, act, gitlab-ka...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: cert-manager, gitlab-kas, buildah, fscrypt, containerd, external-dns, rancher, kots, podman, knative-serving, flux, kubernetes, mattermost, cloud-provider-aws, zot, kine, k3s, kyverno, snyk-cli, aactl, spire-server, cilium-cli, kubernetes-dashboard,...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386

OpenProject’s official docker image ships SECRET_KEY_BASE=OVERWRITE_ME and cookies_serializer = :marshal, creating a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader. This enables potential pre-authentication remote code execution, as noted in the ...

CVE-2026-54232

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. This vulnerability, a dependency confusion attack, allows a remote attacker to execute arbitrary code with root privileges during the Docker build process. By exploiting this, an attacker can compromise the...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, hadoop-fips, hadoop-client-modules, ruby3.3-jrjackson, spark-kubernetes-operator-fips, ruby4.0-jrjackson, geoserver, confluent-common-docker, gradle, ontop-fips, zipkin, conductor, camunda, keycloak, apache-hop, localstack, s3proxy-fips,...

CVE-2026-54515 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, hadoop-fips, hadoop-client-modules, ruby3.3-jrjackson, spark-kubernetes-operator-fips, ruby4.0-jrjackson, geoserver, confluent-common-docker, gradle, ontop-fips, zipkin, conductor, camunda, keycloak, apache-hop, localstack, s3proxy-fips,...

CVE-2026-54515 vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, solr, confluent-kafka, kafka, thingsboard, nextflow, infinispan, logstash, ruby3.2-jrjackson, apache-nifi-registry, apicurio-registry, jenkins, apache-pulsar, spdx-tools-java, gradle, scala, kserve-modelmesh, keycloak-config-cli,...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, solr, confluent-kafka, kafka, thingsboard, nextflow, infinispan, logstash, ruby3.2-jrjackson, apache-nifi-registry, apicurio-registry, jenkins, apache-pulsar, spdx-tools-java, gradle, scala, kserve-modelmesh, keycloak-config-cli,...