Security Bulletin: IBM Operator for Apache Flink is affected by Multiple Vulnerabilities

Summary IBM Operator for Apache Flink is affected by Multiple Vulnerabilities and was addressed in BM Operator for Apache Flink 1.5.5 Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname...

Decepticon v1.1.44

Decepticon — Autonomous Red Team Agent "Another AI hacker? Let us guess — it runs nmap and writes a report." Commercial product demo ☁️ Don't want to self-host? Decepticon is live in the cloud. Skip the Docker setup — run autonomous red-team engagements right from your browser. Open-source CLI dem...

EUVD-2026-83619

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass in the ListArchivedWorkflows API. The root cause is a failure to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals (negated) operator . An attacker with namespace-scoped list...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

xalgorix v4.6.78

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

Exploit for CVE-2026-93659

CVE-2026-93659: Stored XSS in Concrete CMS Community Store Lea...

CVE-2026-85731 vulnerabilities

Vulnerabilities for packages: k8sgpt, helm-push, gitness, helm-mapkubeapis, opentofu, xeol, manifest-tool, k9s, cluster-api-helm-controller, kyverno-notation-aws, rancher-helm, maru, flux-helm-controller, cert-manager-cmctl, helm-set-status, kube-arangodb, tigera-operator, kargo...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: k8sgpt, helm-push, gitness, helm-mapkubeapis, opentofu, xeol, manifest-tool, k9s, cluster-api-helm-controller, kyverno-notation-aws, rancher-helm, maru, flux-helm-controller, cert-manager-cmctl, helm-set-status, kube-arangodb, tigera-operator, kargo...

CVE-2026-1242

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-1242 BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

EUVD-2026-83541

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-1242 BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-1242

The BlockSpare plugin for WordPress (Gutenberg Site Builder Blocks & Starter Sites) is vulnerable to authorization bypass in all versions up to and including 4.2.6 . The root cause is a logic error in the permission callback where an AND (&&) operator was used instead of an OR (||) operator, allo...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: aws-otel-collector, zitadel, distribution-fips, harbor-registry-fips, google-cloud-otel-ops-collector, traefik, loki, tempo-fips, falcosidekick, elastic-agent-fips, grafana-alloy, falcosidekick-fips, fluent-bit-plugin-loki, opentofu-fips, loki-fips, frankenphp-8.2,...

GHSA-W34Q-CM8F-9C5X vulnerabilities

Vulnerabilities for packages: aws-otel-collector, zitadel, distribution-fips, harbor-registry-fips, google-cloud-otel-ops-collector, traefik, loki, tempo-fips, falcosidekick, elastic-agent-fips, grafana-alloy, falcosidekick-fips, fluent-bit-plugin-loki, opentofu-fips, loki-fips, frankenphp-8.2,...