CVE-2026-26287

The External Secrets Operator is vulnerable to a label enforcement bypass in the webhook generator due to an incorrect initialization order. Specifically, the EnforceLabels flag is incorrectly cleared after being set, causing the provider-side check for the external-secrets.io/type=webhook label ...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

EUVD-2026-93468

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabel...

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

Summary A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabels after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped and the operation to succeed while it should have failed with secret...

GHSA-Q7HV-XX6H-Q2X8 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

Summary A bug in the webhook generator initialization order incorrectly cleared the label-enforcement flag EnforceLabels after it was set, resulting in the provider-side check for external-secrets.io/type=webhook being skipped and the operation to succeed while it should have failed with secret...

CVE-2026-67269

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

CVE-2026-67269

The Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 , contains an Improper Privilege Management vulnerability (CWE-269) within the ContainerStorageModule Custom Resource reconciler . A low-privileged remote attacker could exploit this flaw to escalate privileges and gain r...

CVE-2026-67269

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

EUVD-2026-93432

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

sift-hardened

sift-hardened Remplacement direct de sift 17.1.3 qui corrige CVE-2026-85625. Non affilié à crcn/sift.js. Modifications par rapport à la version 17.1.3 Les clés de requête sont énumérées avec Object.keys propriétés propres uniquement, de sorte qu'un Object.prototype.$where pollué n'est pas traité...

Important: Red Hat Security Advisory: OpenShift Security Profiles Operator bug fix and enhancement update

An updated OpenShift Security Profiles Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift Security Profiles Operator v0.10.1 is now available. See the documentation for release information:...

CVE-2026-40564

CVE-2026-40564 : SSRF via FlinkSessionJob.spec.job.jarURI dans flink-kubernetes-operator L'opérateur Kubernetes Apache Flink ne vérifie pas le champ spec.job.jarURI sur les ressources FlinkSessionJob ou FlinkDeployment. Toute personne capable de créer l'une de ces ressources peut définir jarURI s...

CLEANSTART-2026-EQ90075 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or...

Security vulnerability affects the rundeck package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value...

CVE-2026-67269: Improper Privilege Management

Dell Container Storage Modules CSM Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privilege...

PT-2026-106770

Name of the Vulnerable Software and Affected Versions External Secrets Operator versions 0.10.0 through 1.3.1 Description A bug in the webhook generator initialization order incorrectly clears the EnforceLabels label-enforcement flag after it has been set. This causes the provider-side check for...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-103546

The MongoDB Controllers for Kubernetes are vulnerable to improper validation of Ops Manager backup configuration . An attacker with permissions to modify an OpsManager custom resource can trigger unintended administrative changes in Ops Manager. This vulnerability specifically impacts deployments...