CVE-2026-87050

A flaw was found in operator-foundry. GitHub Actions and reusable workflows within the component are referenced using mutable tags e.g., @v0, @v4 instead of fixed commit SHAs. This allows an attacker to potentially alter the code executed in the Continuous Integration CI pipeline through an...

CVE-2018-16509

CVE-2018-16509 Docker Playground "An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction."...

CVE-2026-87049

A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform GCP Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without...

EUVD-2026-74040

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...

CVE-2026-82536

Roo-Code through version 3.54.0 contains an auto-approve bypass in its shell command parsing logic. The root cause is the omission of the bash pipe operator (specifically the stderr-redirecting pipe) from the parser's operator token set. An attacker can craft a command line combining an allowlist...

CVE-2026-82060

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

CVE-2026-82060 Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

EUVD-2026-72947

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

CVE-2026-82060

CVE-2026-82060 is an insufficient validation flaw in MongoDB Server affecting sharded collections. During document insertion, shard key values were not properly validated, allowing authenticated users to store operator-shaped objects as shard key values. When change stream events for such documen...

Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-80219

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

CVE-2026-78234

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name CN supplied by the author of a namespaced Hawtio custom resource. Because the operator...

CVE-2026-80219 Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

CVE-2026-80219

A flaw in hawtio-operator (OpenShift cluster mode) allows OAuth token theft. The operator creates a cluster-scoped OAuthClient with GrantMethod: auto and no client secret (public client). Because redirect URIs are derived from an operator-created Route whose hostname is tenant-controlled via the ...

EUVD-2026-72694

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval GrantMethod: auto and no client secret public client. The redirect URIs are derived from the operator-created Route, whose hostname is...

CVE-2026-78234 Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name CN supplied by the author of a namespaced Hawtio custom resource. Because the operator...

CVE-2026-78234 Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name CN supplied by the author of a namespaced Hawtio custom resource. Because the operator...

CVE-2026-78234

hawtio-operator in OpenShift contains a Service CA signing oracle flaw. The operator reads the Service CA private signing key from the openshift-service-ca namespace and mints client certificates whose Subject CN is taken directly from the author of a namespaced Hawtio custom resource. Because th...

EUVD-2026-72693

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name CN supplied by the author of a namespaced Hawtio custom resource. Because the operator...