CLEANSTART-2026-II25831 Security fixes in prometheus-operator 0.69.1-r1

Package prometheus-operator version 0.69.1-r1 fixes 29 vulnerabilities: ghsa-8rm2-7qqf-34qm, ghsa-wg65-39gg-5wfj, ghsa-vffh-x6r8-xx99, ghsa-fw8g-cg8f-9j28, CVE-2026-39820...

CLEANSTART-2026-ND31418 Security fixes in percona-xtradb-cluster-operator 1.19.1-r1

Package percona-xtradb-cluster-operator version 1.19.1-r1 fixes 9 vulnerabilities: CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825...

CLEANSTART-2026-OD14993 Security fixes in spark-operator 2.4.0-r4

Package spark-operator version 2.4.0-r4 fixes 11 vulnerabilities: CVE-2026-39817, CVE-2026-39820, CVE-2026-39826, CVE-2026-39823, CVE-2026-42499...

CLEANSTART-2026-TB08194 Security fixes in opensearch-k8s-operator-fips 2.5.1-r3

Package opensearch-k8s-operator-fips version 2.5.1-r3 fixes 8 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...

CLEANSTART-2026-OZ77297 Security fixes in tigera-operator 1.42.0-r0

Package tigera-operator version 1.42.0-r0 fixes 27 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33811, CVE-2026-33814...

CLEANSTART-2026-RB80888 Security fixes in fluent-operator-fips 3.6.0-r5

Package fluent-operator-fips version 3.6.0-r5 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811...

CLEANSTART-2026-CY22332 Security fixes in helm-operator 1.42.2-r1

Package helm-operator version 1.42.2-r1 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-AR50437 Security fixes in spark-operator 2.2.1-r4

Package spark-operator version 2.2.1-r4 fixes 11 vulnerabilities: CVE-2026-39817, CVE-2026-39820, CVE-2026-39826, CVE-2026-39823, CVE-2026-42499...

CLEANSTART-2026-BL34124 Security fixes in strimzi-kafka-operator 0.46.1-r4

Package strimzi-kafka-operator version 0.46.1-r4 fixes 1 vulnerabilities: CVE-2025-58057...

CLEANSTART-2026-XI30984 Security fixes in zookeeper-operator 0.2.15-r1

Package zookeeper-operator version 0.2.15-r1 fixes 3 vulnerabilities: CVE-2023-44487, CVE-2023-39325, CVE-2024-24786...

CLEANSTART-2026-SC78735 Security fixes in minio-operator 6.0.4-r5

Package minio-operator version 6.0.4-r5 fixes 4 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp, ghsa-29wx-vh33-7x7r, CVE-2024-51744...

CLEANSTART-2026-QR05590 Security fixes in clickhouse-operator 0.25.5-r0

Package clickhouse-operator version 0.25.5-r0 fixes 2 vulnerabilities: CVE-2025-22868, CVE-2025-22870...

CLEANSTART-2026-MU34721 Security fixes in minio-operator 6.0.4-r2

Package minio-operator version 6.0.4-r2 fixes 4 vulnerabilities: ghsa-mh63-6h87-95cp, ghsa-29wx-vh33-7x7r, CVE-2025-30204, CVE-2024-51744...

EUVD-2026-51032

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CVE-2026-44097

The CVE-2026-44097 entry describes a low-privileged remote attacker with operator access who can upload arbitrary files through the firmware-update REST endpoint, leading to persistent attacker-controlled data and potential DoS via resource exhaustion. The root cause is an unrestricted file uploa...

CVE-2026-15240

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240 Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240

The CVE refers to the Customer Switching for WooCommerce plugin for WordPress, affected in versions before 2.1.3. The root cause is insecure binding of an active user-switching session to the initiating operator, allowing a lower-privilege account that an operator is switched into to be resolved ...

EUVD-2026-50996

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

PT-2026-66460

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...