GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor, ruby3.2-fluentd-kubernetes-daemonset...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor, ruby3.2-fluentd-kubernetes-daemonset...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

renovate-operator v5.4.0

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, commercial-gitlab-rails-ee, cinc-auditor, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, pact-broker-docker, commercial-gitlab-rails-ee, logstash, cinc-auditor, gitlab-rails-ce-fips, ruby3.2-fluentd-kubernetes-daemonset, pghero, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, pghero-fips...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, commercial-gitlab-rails-ee, cinc-auditor, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, pact-broker-docker, commercial-gitlab-rails-ee, logstash, cinc-auditor, gitlab-rails-ce-fips, ruby3.2-fluentd-kubernetes-daemonset, pghero, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, pghero-fips...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

EUVD-2026-48612

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006

lakeFS

CVE-2026-66006: Missing Authentication for Critical Function

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

PT-2026-64319

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.83.0 commit 71a45ee Description An authentication bypass exists in the '/setup comm prefs' endpoint. This allows unauthenticated attackers to overwrite operator metadata, such as email, name, and company, after the...