1388 matches found
PT-2026-38359
Name of the Vulnerable Software and Affected Versions Rancher versions prior to v2.14.1 Rancher versions prior to v2.13.5 Rancher versions prior to v2.12.9 Rancher versions prior to v2.11.13 Rancher version v2.10.11 Description Fleet's Helm deployer fails to fully apply ServiceAccount impersonati...
Moderate: Red Hat Enhancement Advisory: Red Hat Edge Manager Version 1.1.2
Red Hat Edge Manager Version 1.1.2 Red Hat Edge Manager RHEM provides simple, scalable, and secure management for edge fleets. Users declare their target OS image, host configuration, and applications; the RHEM agent then automatically rolls out these configurations, reporting health and progress...
CVE-2026-41506 vulnerabilities
Vulnerabilities for packages: melange, grafana-fips, gitsign, snyk-cli, trivy-operator, pulumi-kubernetes-operator, external-secrets-operator, argocd-image-updater, syft, witness, argo-workflows-fips, src-fingerprint, cerbos, goreleaser, grafana, trivy-operator-fips, cerbos-fips,...
GHSA-MH2Q-Q3FH-2475 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudwatchevents, cephcsi, flux-helm-controller, cluster-api, crossplane-provider-aws-lambda-fips, crossplane-provider-aws-sqs-fips, crossplane-provider-aws-s3-fips, crossplane-provider-aws-sns-fips, k3d, vexctl, argocd-image-updater,...
CVE-2026-29181 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudwatchevents, cephcsi, flux-helm-controller, cluster-api, crossplane-provider-aws-lambda-fips, crossplane-provider-aws-sqs-fips, crossplane-provider-aws-s3-fips, crossplane-provider-aws-sns-fips, k3d, vexctl, argocd-image-updater,...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: eksctl, argo-rollouts, redis-operator, emissary, teleport, consul-k8s, kiali, velero, k8sgpt, kargo, k9s, kubescape, k3s, gitlab-kas, k8ssandra-client, skaffold, dynamic-localpv-provisioner, docker-cli-buildx, k8sgpt-operator, trivy-operator, argocd-image-updater,...
CVE-2026-35469 vulnerabilities
Vulnerabilities for packages: eksctl, argo-rollouts, redis-operator, emissary, teleport, consul-k8s, kiali, velero, k8sgpt, kargo, k9s, kubescape, k3s, gitlab-kas, k8ssandra-client, skaffold, dynamic-localpv-provisioner, docker-cli-buildx, k8sgpt-operator, trivy-operator, argocd-image-updater,...
BIT-KIBANA-2026-4498 Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope
Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...
BIT-KIBANA-2026-33461 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...
BIT-KIBANA-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...
BIT-ELK-2026-4498 Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope
Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...
BIT-ELK-2026-33461 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...
BIT-ELK-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...
PT-2026-32407
Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...
PT-2026-32409
Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...
PT-2026-32432
Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...
PT-2026-32433
Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...
PT-2026-32408
Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...