61586 matches found
PT-2026-85988
Package eck-operator version 3.2.0-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
PT-2026-85938
Package tigera-operator-fips version 1.37.2-r0 fixes 2 vulnerabilities: ghsa-6v2p-p543-phr9, ghsa-mf24-chxh-hmvj...
PT-2026-66395
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...
PT-2026-85867
Package prometheus-operator-fips version 0.87.0-r1 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
PT-2026-86078
Package minio-operator-fips version 5.0.18-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
PT-2026-86003
Package minio-operator-fips version 7.0.1-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...
PT-2026-85913
Package victoriametrics-operator-fips version 0.65.0-r0 fixes 1 vulnerabilities: ghsa-66jq-2c23-2xh5...
PT-2026-66425
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...
PT-2026-86089
Package kube-logging-operator version 6.2.2-r0 fixes 6 vulnerabilities: ghsa-mxw3-3hh2-x2mh, ghsa-jfh8-c2jp-hdph, ghsa-v9wx-v5z4-wgfj, ghsa-59gp-qqm7-cw4j, ghsa-g7gv-6qhm-4h2j...
CVE-2026-44097: Unrestricted Upload of File with Dangerous Type
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...
CVE-2026-14923: Incorrect Authorization
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...
CVE-2026-18378: Server-Side Request Forgery (SSRF)
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...
PT-2026-66459
Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...
CVE-2026-18382: Server-Side Request Forgery (SSRF)
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...
PT-2026-66461
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client id and clien...
CVE-2026-18381: Server-Side Request Forgery (SSRF)
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
PT-2026-66460
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
PT-2026-85946
Package helm-operator version 1.42.3-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...