GHSA-QVQC-4C52-X6QP vulnerabilities

Vulnerabilities for packages: kube-arangodb, gpu-operator-fips, gpu-operator, guac, kube-arangodb-fips...

CVE-2026-49349 vulnerabilities

Vulnerabilities for packages: kube-arangodb, gpu-operator-fips, gpu-operator, guac, kube-arangodb-fips...

Authorization Bypass

Apache Camel is vulnerable to Authorization Bypass. The vulnerability is due to insufficient validation of user-controlled Build resources, which allows an authorized attacker to generate Pods in arbitrary Kubernetes namespaces, including the operator namespace...

SUSE CVE-2026-47770

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion uncontrolled recursion. The crash occurs in jq's recursive...

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

GHSA-C6V2-3FFM-VCMC Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.3.3. Vulnerability Details CVEID:CVE-2026-45447 DESCRIPTION: Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, external-secrets-operator, skaffold, gitea-fips, aactl, drone-fips, minio-fips, drone, harbor-fips, mattermost, kube-conformance, prometheus-fips, traefik-fips, upwind-agent, flux-source-controller-fips, etcd, seaweedfs-rocksdb, helm, kubescape,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, apply-cve-bump, external-secrets-operator, terraform-provider-azurerm, policy-controller, terragrunt, melange, fulcio, grype-fips, teleport-operator-fips, skaffold, gitea-fips, crossplane-provider-azure-solutions, docker-fips, gomplate,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: terragrunt, melange, fulcio, grype-fips, teleport-operator-fips, skaffold, crossplane-provider-aws-osis, crossplane-provider-aws-cloudformation, consul, drone-fips, crossplane-provider-aws-rolesanywhere, gitlab-runner-fips, flux-source-controller-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: terragrunt, melange, fulcio, grype-fips, teleport-operator-fips, skaffold, crossplane-provider-aws-osis, crossplane-provider-aws-cloudformation, consul, drone-fips, crossplane-provider-aws-rolesanywhere, gitlab-runner-fips, flux-source-controller-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, apply-cve-bump, external-secrets-operator, terraform-provider-azurerm, policy-controller, terragrunt, melange, fulcio, grype-fips, teleport-operator-fips, skaffold, gitea-fips, crossplane-provider-azure-solutions, docker-fips, gomplate,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, external-secrets-operator, skaffold, gitea-fips, aactl, drone-fips, minio-fips, drone, harbor-fips, mattermost, kube-conformance, prometheus-fips, traefik-fips, upwind-agent, flux-source-controller-fips, etcd, seaweedfs-rocksdb, helm, kubescape,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, apply-cve-bump, external-secrets-operator, terragrunt, melange, grype-fips, teleport-operator-fips, skaffold, gitea-fips, gomplate, aactl, pulumi-kubernetes-operator, minio-fips, mattermost, harbor-fips, prometheus-fips, kube-conformance,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, apply-cve-bump, external-secrets-operator, longhorn-cli, melange, terragrunt, grype-fips, teleport-operator-fips, skaffold, gitea-fips, gomplate, docker-fips, aactl, pulumi-kubernetes-operator, drone-fips, gitlab-runner-fips, minio-fips, drone,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: gitea, nerdctl, trivy-operator, telegraf, opentelemetry-collector, zot, fscrypt, cilium, chisel, zarf, trivy, spire-server, external-secrets-operator, osv-scanner, external-dns, k3s, loki, helm, k9s, mattermost, skaffold, kine, cloud-provider-aws,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: gitea, trivy-operator, crossplane-provider-family-azure, openbao, opentelemetry-collector, zot, syft, guac, terragrunt, teleport, crossplane-provider-aws-memorydb, osv-scanner, gatus, step-kms-plugin, buildkitd, k3s, crossplane-provider-aws-s3, kine,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gitea, trivy-operator, crossplane-provider-family-azure, openbao, opentelemetry-collector, zot, syft, guac, terragrunt, teleport, osv-scanner, gatus, step-kms-plugin, buildkitd, k3s, kine, flux-source-controller, gitlab-runner, prometheus, neuvector-sigstore-interfac...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: nerdctl, telegraf, opentelemetry-collector, zot, fscrypt, cilium, spire-server, external-secrets-operator, external-dns, k3s, loki, helm, mattermost, kine, cloud-provider-aws, rancher-agent, rancher, gitlab-kas, kaf, kubernetes, prometheus, podman, containerd,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: gitea, trivy-operator, crossplane-provider-family-azure, openbao, opentelemetry-collector, zot, syft, guac, terragrunt, teleport, crossplane-provider-aws-memorydb, osv-scanner, gatus, step-kms-plugin, buildkitd, k3s, crossplane-provider-aws-s3, kine,...