PT-2026-59241

Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...

CVE-2026-62147: Incorrect Authorization

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces...

PT-2026-63679

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63663

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63735

Multiple security vulnerabilities affect the gpu-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63700

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63707

Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63669

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63726

Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63695

Multiple security vulnerabilities affect the eck-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-59171

Summary The ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute JavaScript in the operator's browser. This affects...

PT-2026-63731

Multiple security vulnerabilities affect the victoriametrics-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63717

Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63714

Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63703

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63666

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63718

Multiple security vulnerabilities affect the minio-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

BIT-AIRFLOW-2026-49487 Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret for example a provider API key into its trigger, any authenticated user with DAG-scoped task-instance read acces...

GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities

Vulnerabilities for packages: cloudbeat, image-factory, aactl, zarf-fips, neuvector-sigstore-interface-fips, kubescape, ratify-fips, kubescape-server, kyverno, trivy-operator, teleport, cloudbeat-fips, tekton-chains, kubescape-server-fips, kyverno-fips, falcoctl, trivy, tbot, kyverno-notation-aws...

Security Bulletin: Vulnerability in IBM Operator for PostgreSQL

Summary A vulnerability was addressed in IBM Operator for PostgreSQL version v28.4.0. Vulnerability Details CVEID:CVE-2026-25680 DESCRIPTION: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CWE:CWE-400: Uncontrolled Resource Consumption CVSS Source:...