CVE-2026-115883

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115883

The LangGraph checkpoint savers, specifically the PostgresStore , AsyncPostgresStore , SqliteStore , and AsyncSqliteStore components, are vulnerable to a cross-namespace data access issue. The root cause is that these stores flatten namespace labels using ".".join(namespace), but validation only ...

EUVD-2026-109182

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115883 LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115365

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other...

EUVD-2026-108290

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other...

CVE-2026-115365

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other...

PT-2026-121545

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other...

CVE-2026-112778

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...

EUVD-2026-104584

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...

CVE-2026-112778: Missing Authorization

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...

CVE-2026-53718

A flaw was found in Envoy Gateway. An attacker could exploit a vulnerability in how HTTPRoute handles custom backend references. This allows a route-owning namespace to access and utilize resources in another namespace without proper authorization, bypassing the intended Gateway API cross-namespa...

CVE-2026-54495

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

CVE-2026-54495

CVE-2026-54495 affects the OpenFeature Operator (version 0.9.2 and earlier). A tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with {NAMESPACE}/{NAME} syntax to reference a FeatureFlagSource or InProcessConfiguration in another namespace....

GHSA-XV26-6W52-CPH6 vulnerabilities

Vulnerabilities for packages: argo-workflows...

Linux Distros Unpatched Vulnerability : CVE-2026-89766

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing...

DEBIAN-CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

UBUNTU-CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

AZL-100073 CVE-2026-81003 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-89060

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference...