trivy-enforcer

trivy-enforcer EXPERIMENTAL Kubernetes Operator for Image Assurance It works as Admission Controller protecting unsafe images from being deployed Custom Controller watching ImageVulnerability CRD and scanning the image in the custom resource automatically Setup $ kubectl apply -f manifests/opa.ya...

Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029

Summary IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029 because of CR author can redirect arcgis-admin RoleBinding to own ServiceAccount, CR author can override...

CVE-2026-40564

CVE-2026-40564: SSRF via FlinkSessionJob.spec.job.jarURI in flink-kubernetes-operator The Apache Flink Kubernetes Operator does not check the spec.job.jarURI field on FlinkSessionJob or FlinkDeployment resources. Anyone who can create one of those resources can set jarURI to any URL. When the...

Important: Red Hat Security Advisory: VolSync v0.16 security fixes and container updates

VolSync v0.16 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important: Red Hat Security Advisory: VolSync v0.15 security fixes and container updates

VolSync v0.15 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2026-81303 Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

CVE-2026-47680

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

EUVD-2026-74295

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

CVE-2026-77968 Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-19274

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 contains a vulnerability in the Instana Agent Operator where cluster-scoped RBAC objects are keyed solely by the bare Custom Resource name with no namespace disambiguation. An authenticated Kubernetes tenant can exploit this by ...

renovate-operator v6.2.0

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

Important: Red Hat Security Advisory: Submariner v0.24 security fixes and container updates

Submariner v0.24 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, kyverno, emissary, flux-kustomize-controller, tkn, apisix-ingress-controller, azure-service-operator, cloud-provider-azure, cluster-api-azure-controller, fluent-operator, kubescape, k3s, caddy, gitlab-kas, external-secrets-operator, openbao,...

Files Or Directories Accessible To External Parties

Apache Flink Kubernetes Operator is vulnerable to Files or Directories Accessible to External Parties. The vulnerability is due to insufficient validation of the FlinkSessionJob jarURI, including missing scheme, host, and IP-range restrictions, which allows users with CR create permissions to rea...

GO-2025-3690 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator, seaweedfs-operator-fips...

GO-2026-5099 vulnerabilities

Vulnerabilities for packages: argocd-image-updater...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: dagger, flux-kustomize-controller, flux, goreleaser, k8sgpt, pulumi-language-java, kargo, k9s, kubescape, skaffold, nuclei, guac, argocd-image-updater, bom, gptscript, kubevela, melange, snyk-cli, zot, gitsign, tfsec, flux-source-controller, argo-events, kots, trivy,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: dagger, flux-kustomize-controller, flux, goreleaser, k8sgpt, pulumi-language-java, kargo, k9s, kubescape, skaffold, nuclei, guac, argocd-image-updater, bom, gptscript, kubevela, melange, snyk-cli, zot, gitsign, tfsec, flux-source-controller, argo-events, kots, trivy,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: dagger, trufflehog, kyverno, teleport, flux, nfpm, pulumi-language-java, cerbos, kargo, k9s, kubescape, xeol, skaffold, external-secrets-operator, nuclei, trivy-operator, guac, argocd-image-updater, bom, gptscript, kubevela, melange, snyk-cli, zot, gitsign, tfsec,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: bento, gogatekeeper, dask-gateway, nginx-prometheus-exporter, crossplane-provider-aws-rds, nerdctl, kyverno-policy-reporter-ui, minio-operator, helm-set-status, podinfo, lazygit, cloud-provider-vsphere, boring-registry, bom, ratify, kserve-modelmesh-serving, blobfuse...