CVE-2025-22248 [pgpool] Unauthenticated access to postgres through pgpool

The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOLSRCHECKUSER is the user that Pgpool itself uses to perform streaming replication check...

Important: Red Hat Security Advisory: RHSA: Submariner 0.18.5 - bug and security update

Submariner 0.18 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CV...

Malicious code in backstage-plugin-kubernetes-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d5e128ce958505a3df2acbdc6b87aaf80b05e6b5a1dec494681ab2ceced6a0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WebAssembly Jobs and CronJobs in Kubernetes with SpinKube & the Spin Command Trigger

Learn how to run WebAssembly workloads as Kubernetes Jobs and CronJobs using SpinKube and the Spin command trigger...

CVE-2025-33093

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

Unauthorized Access

github.com/inspektor-gadget/inspektor-gadget is vulnerable to unauthorized access. The vulnerability is due to insufficient access controls due to reliance on client access with valid TLS certificates or cluster access in daemon or Kubernetes modes, allows an attacker to gain unauthorized access ...

The vulnerability affects the FSM component of the software used for traffic management, load balancing, and security protection in BIG-IP Next Service Proxy for Kubernetes (SPK), as well as the access control and remote authentication mechanisms in BIG-IP. This allows attackers to cause service failures.

The vulnerability of the fsm component in BIG-IP Next Service Proxy for Kubernetes SPK, as well as in tools for access control and remote authentication, is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

SUSE CVE-2025-32777

Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the scheduler. This is a privilege...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.7 container updates

Red Hat Advanced Cluster Management for Kubernetes 2.11.7 General Availability release images, with updates to container images and bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which give...

Security Bulletin: IBM Cloud Kubernetes Service on Ubuntu20 is affected by a FreeType Remote Code Execution security vulnerability (CVE-2025-27363)

Summary IBM Cloud Kubernetes Service is affected by a FreeType Remote Code Execution security vulnerability CVE-2025-27363 which is included in Ubuntu20 distributions, but not applicable to Ubuntu24 distributions. Vulnerability Details CVE-2025-27363 Description: An out of bounds write exists in...

Kubernetes IngressNightmare: Wake Up and Fight Back with Microsegmentation

Discover how to defend Kubernetes from Ingress vulnerabilities with microsegmentation and Zero Trust security from Akamai. Stay protected — inside and out...

CVE-2025-33093

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

CVE-2025-33093

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

CVE-2025-33093 IBM Sterling Partner Engagement Manager information disclosure

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

CVE-2025-33093 IBM Sterling Partner Engagement Manager information disclosure

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

Security Bulletin: IBM Sterling Partner Engagement Manager has several issues with secrets management (CVE-2025-33093)

Summary IBM Sterling Partner Engagement Manager's JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret. This issue has been addressed in the latest Helm Chart. Vulnerability Details CVEID:CVE-2025-33093 DESCRIPTION: IBM Sterling Partner Engagement Manager's JWT secr...

Important: Red Hat Security Advisory: multicluster Engine for Kubernetes 2.6.7 container updates

multicluster engine for Kubernetes 2.6.7 General Availability release images, with updates to container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

PT-2025-20069

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.0 through 6.2.2 Description The issue concerns the storage of the JWT secret in public Helm Charts, rather than as a Kubernetes secret. This affects IBM Sterling Partner Engagement Manager...

Microsoft Warns Default Helm Charts Could Leave Kubernetes Apps Exposed to Data Leaks

Microsoft has warned that using pre-made templates, such as out-of-the-box Helm charts, during Kubernetes deployments could open the door to misconfigurations and leak valuable data. "While these 'plug-and-play' options greatly simplify the setup process, they often prioritize ease of use over...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.10.8 container updates

Red Hat Advanced Cluster Management for Kubernetes 2.10.8 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...