CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: cue, kyverno-policy-reporter-ui, cilium-cli, prometheus-pushgateway, gh, kubernetes-ingress-defaultbackend, polaris, cluster-api-provider-vsphere, buildah, docker-machine-driver-linode, fluxcd-kustomize-mutating-webhook, dataplaneapi, mattermost,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kafka-proxy, cloud-provider-vsphere, cue, falco-exporter, terraform-provider-sendgrid, prometheus-adapter, apache-exporter, kyverno-policy-reporter-ui, step-ca, cilium-cli, prometheus-pushgateway, apisix-ingress-controller, golangci-lint, gh, seaweedfs, spire-server,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: cue, kyverno-policy-reporter-ui, cilium-cli, prometheus-pushgateway, gh, kubernetes-ingress-defaultbackend, polaris, cluster-api-provider-vsphere, buildah, docker-machine-driver-linode, fluxcd-kustomize-mutating-webhook, dataplaneapi, mattermost,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: podinfo-fips, commercial-chainloop-backend, mountpoint-s3-csi-driver, supercronic-fips, karpenter, flux-image-reflector-controller-fips, gh, kyverno-policy-reporter-plugins-kyverno-fips, flux-notification-controller, secrets-store-csi-driver-provider-aws,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: podinfo-fips, commercial-chainloop-backend, mountpoint-s3-csi-driver, supercronic-fips, karpenter, flux-image-reflector-controller-fips, gh, kyverno-policy-reporter-plugins-kyverno-fips, flux-notification-controller, secrets-store-csi-driver-provider-aws,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, gitleaks, commercial-chainloop-backend, buildkite-agent, docker-compose-fips, vault-secrets-operator, kube-fluentd-operator, tkn, gh, slsa-verifier, net-kourier, k8s-device-plugin, witness, hubble, ipfs-cluster, envconsul-fips, qemu-guesthelper...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, gitleaks, commercial-chainloop-backend, buildkite-agent, docker-compose-fips, vault-secrets-operator, kube-fluentd-operator, tkn, gh, slsa-verifier, net-kourier, k8s-device-plugin, witness, hubble, ipfs-cluster, envconsul-fips, qemu-guesthelper...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, commercial-chainloop-backend, buildkite-agent, cluster-api-provider-vsphere, docker-compose-fips, vault-secrets-operator, kube-fluentd-operator, cadence-fips, crossplane-provider-aws-ecs, terraform-provider-azuread-fips, tkn, gh, slsa-verifier,...

CVE-2026-32280 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, gitleaks, commercial-chainloop-backend, buildkite-agent, cluster-api-provider-vsphere, docker-compose-fips, vault-secrets-operator, kube-fluentd-operator, zabbix-agent2, cadence-fips, crossplane-provider-aws-ecs, terraform-provider-azuread-fips...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, gitleaks, commercial-chainloop-backend, buildkite-agent, cluster-api-provider-vsphere, docker-compose-fips, vault-secrets-operator, kube-fluentd-operator, zabbix-agent2, cadence-fips, crossplane-provider-aws-ecs, terraform-provider-azuread-fips...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, gitleaks, commercial-chainloop-backend, buildkite-agent, cluster-api-provider-vsphere, docker-compose-fips, vault-secrets-operator, kube-fluentd-operator, zabbix-agent2, cadence-fips, crossplane-provider-aws-ecs, terraform-provider-azuread-fips...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, gitleaks, commercial-chainloop-backend, buildkite-agent, cluster-api-provider-vsphere, docker-compose-fips, vault-secrets-operator, kube-fluentd-operator, zabbix-agent2, cadence-fips, crossplane-provider-aws-ecs, terraform-provider-azuread-fips...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: gitleaks, cluster-api-provider-vsphere, cargobump, virt-handler-fips, cadence-fips, terraform-provider-azuread-fips, crossplane-provider-aws-cognitoidentity-fips, chisel, amazon-cloudwatch-agent-fips, hubble, ucd, local-path-provisioner-fips, nri-elasticsearch,...

CVE-2026-39961

Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From 0.31.0 to before 0.37.0, a developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys...

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

Impact A developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its ClusterRole and write...

EUVD-2026-20965

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource...

GHSA-99J8-WV67-4C72 Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

Impact A developer with create permission on ClickhouseUser CRDs in their own namespace can exfiltrate secrets from any other namespace — production database credentials, API keys, service tokens — with a single kubectl apply. The operator reads the victim's secret using its ClusterRole and write...

CVE-2026-35669

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gain elevated privileges and perform...

CVE-2026-35660

OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /reset or /new messages with an explicit sessionKey ...

CVE-2026-35657

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can access session history without proper operator read permissions by sending HTTP requests to the vulnerable endpoint...