GO-2026-4399 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-csi-driver, mariadb-operator, percona-server-mongodb-operator, cert-manager-webhook-pdns, step-issuer, cert-manager-istio-csr, opentelemetry-operator, cert-manager-cmctl...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: gitlab-pages, aws-nuke, nri-discovery-kubernetes, promxy, govulncheck, rancher-webhook, kyverno, argo-rollouts, buildah, src-fingerprint, pinact, tofu-controller, temporal-server, addon-resizer, percona-server-mongodb-operator, containerd, glab, envoy-gateway, step-c...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: terraform-provider-aws, otel-cli, rancher-agent, govulncheck, nri-redis, bom, knative-operator, addon-resizer, sftpgo, step-ca, wuzz, amazon-cloudwatch-agent-operator, amazon-k8s-cni, nsc, postgres-operator, terraform-provider-sendgrid, kubescape, whereabouts, dex,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, mesosphere-vsphere-csi, http-echo, kubelet-csr-approver, govulncheck, terraform-provider-pagerduty, nri-redis, bom, src-fingerprint, kubernetes-csi-external-attacher, tofu-controller, percona-server-mongodb-operator,...

CLEANSTART-2026-SP46945 Security fixes in percona-server-mongodb-operator 1.23.0-r0

Package percona-server-mongodb-operator version 1.23.0-r0 fixes 22 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-CN16573 Security fixes in percona-server-mongodb-operator 1.22.0-r1

Package percona-server-mongodb-operator version 1.22.0-r1 fixes 32 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-BE68531 Security fixes for CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-33814, CVE-2026-35469, CVE-2026-39821, CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-pc3f-x583-g7j2, ghsa-pjcq-xvwq-hhpj applied in versions: 1.22.0-r1

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KJ85611 Security fixes for CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-33814, CVE-2026-35469, CVE-2026-39821, CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-pc3f-x583-g7j2, ghsa-pjcq-xvwq-hhpj applied in versions: 1.22.0-r1

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WA48911 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: rancher, rancher-agent, spqr, rancher-webhook, kyverno, frp, xeol, percona-server-mongodb-operator, yunikorn-k8shim, opentofu, minio, external-secrets-operator, gitea, sftpgo-plugin-auth, bento, cert-manager-istio-csr, cert-manager, ratify, telegraf, dex, teleport,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: rancher, rancher-agent, spqr, rancher-webhook, kyverno, frp, xeol, percona-server-mongodb-operator, yunikorn-k8shim, opentofu, minio, external-secrets-operator, gitea, sftpgo-plugin-auth, bento, cert-manager-istio-csr, cert-manager, ratify, telegraf, dex, teleport,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: harbor, terraform, seaweedfs-fips, commercial-grafana, spqr, rancher, gitea, ratify, seaweedfs, seaweedfs-rocksdb, bento, kyverno-fips, percona-server-mongodb-operator, versitygw-fips, rclone, grafana, openbao, vault, cert-manager-google-cas-issuer-fips, dex,...

CVE-2026-40351 FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

EUVD-2026-23557

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

CVE-2026-40351

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: consul-k8s, falcoctl, commercial-grafana, datadog-agent, eck-operator, rancher, kargo, headlamp-fips, falcoctl-fips, rke2-runtime, cluster-api-fips, hubble-fips, rancher-fleet, percona-server-mongodb-operator, trident, grafana, eck-operator-fips, rke2-runtime-fips,...

PT-2026-33519

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, cert-manager-csi-driver, mariadb-operator-fips, cert-manager-istio-csr, cert-manager-openshift-routes, opentelemetry-operator-fips, aws-privateca-issuer, step-issuer, mariadb-operator, percona-server-mongodb-operator,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-csi-driver, mariadb-operator, percona-server-mongodb-operator, cert-manager-webhook-pdns, step-issuer, cert-manager-istio-csr, opentelemetry-operator, cert-manager-cmctl...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-csi-driver, mariadb-operator, percona-server-mongodb-operator, cert-manager-webhook-pdns, step-issuer, cert-manager-istio-csr, opentelemetry-operator, cert-manager-cmctl...