Important: Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release

The 1.4.3 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20...

trivy-operator v0.33.0

Kubernetes-native security toolkit. Documentation Introduction The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernete...

CVE-2026-17617

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

CVE-2026-17617

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.14 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.14 and Red Hat build of Keycloak 26.4.14 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

CVE-2026-17617 Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

EUVD-2026-53450

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

CVE-2026-17617

IBM Application Gateway Operator (versions 22.2–26.06) is affected by a Server-Side Request Forgery (SSRF) due to insufficient validation of URLs in custom resources. The issue is documented across multiple sources (NVD entry and IBM security bulletin), with the IBM bulletin listing CVSS v3.1 bas...

Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

MAL-2026-13230 Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-58016 DESCRIPTION: A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing...

CVE-2026-71259: Incomplete List of Disallowed Inputs

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-17617: Server-Side Request Forgery (SSRF)

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

PT-2026-68224

Name of the Vulnerable Software and Affected Versions IBM Application Gateway Operator versions 22.2 through 26.06 Description Insufficient validation of URLs specified in custom resources allows for Server-Side Request Forgery SSRF, a condition where an attacker can induce the server to make...

GHSA-G6CJ-PR64-35W5 vulnerabilities

Vulnerabilities for packages: openstack-placement-2025.2, apache-beam-python-3.11-sdk, crossplane-function-pythonic, mlflow, openstack-keystone-2026.1, gitlab-cng-fips, gitlab-cng, airflow-core, opal, openstack-nova-2026.1, openstack-horizon-2025.2, dbt-snowflake, ansible-operator-fips,...

CVE-2026-69247 vulnerabilities

Vulnerabilities for packages: openstack-placement-2025.2, apache-beam-python-3.11-sdk, crossplane-function-pythonic, mlflow, openstack-keystone-2026.1, gitlab-cng-fips, gitlab-cng, airflow-core, opal, openstack-nova-2026.1, openstack-horizon-2025.2, dbt-snowflake, ansible-operator-fips,...

CVE-2026-70484 Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied imagegeneration flag and did not re-check the features.imagegeneration permission that the direct image routes and...

CVE-2026-70484

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trusted a client-supplied imagegeneration flag and did not re-check the features.imagegeneration permission that the direct image routes and...

CVE-2026-70484

Open WebUI vulnerability CVE-2026-70484 affects the self-hosted AI platform Open WebUI in versions 0.7.0 through 0.11.0. The legacy chat-completions features did not re-check the features.image_generation permission enforced on direct image routes and native function-calling paths, allowing an au...