PT-2026-47571

Impact The Ironic Standalone Operator IRSO is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privilege controller modifying user-owned resources...

Linux Distros Unpatched Vulnerability : CVE-2026-44394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to...

RHEL 10 : flatpak (RHSA-2026:21757)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21757 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak:...

RHEL 10 : .NET 9.0 (RHSA-2026:21754)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21754 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation...

Security update for the Linux Kernel (important)

openSUSE security update: security update for the linux kernel ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20826-1 Rating: important References: bsc1215199 bsc1234634 bsc1241259 bsc1243603 bsc1248754 bsc1249104 bsc1250951 bsc1253471 bsc1254518...

RHEL 9 : firefox (RHSA-2026:21743)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:21743 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

PT-2026-47580

Summary CAPM3 is Metal3's Cluster API CAPI provider for baremetal provisioning in Kubernetes. Multiple cross-namespace access control vulnerabilities in Cluster API Provider Metal3 allow users with permissions to create or modify CAPM3 resources in one namespace to reference, read, or claim...

PT-2026-47556

Impact The Ironic Standalone Operator IRSO is the operator to maintain an Ironic deployment for Metal3. The Prometheus metrics exporter binds to 0.0.0.0 all network interfaces by default with no authentication. The default config is disabled. If enabled, this exposes operational metrics to any ho...

PT-2026-44892

OpenClaw before 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals that allows exec-authorized users to resolve plugin approvals through the exec approver gate. Attackers with limited exec approval permissions can bypass intended approval splits to approve plugin...

Linux Distros Unpatched Vulnerability : CVE-2026-48103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM Windows Imaging...

RHEL 8 : xorg-x11-server (RHSA-2026:21715)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21715 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical us...

OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handlescopedtoken function in the mapped...

GHSA-WHQR-FGM5-X77Q OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handlescopedtoken function in the mapped...

CVE-2026-49093

Server-Side Request Forgery CWE-918 in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block...

CVE-2026-42398

Server-Side Request Forgery CWE-918 in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...