SpiceDB 安全漏洞

SpiceDB is a fine-grained permissions database from the Authzed team. A security vulnerability exists in SpiceDB versions prior to 1.45.2, which stems from a write relation call not being handled correctly when using the exclude operator, which could lead to incorrect permission check results...

FBI Wants to Know Who Runs Archive.ph

The FBI has issued a federal subpoena to domain registrar Tucows, demanding extensive billing and session records to unmask the anonymous operator of Archive.ph Archive.is and Archive.today. The site, known for bypassing paywalls, is now the subject of an undisclosed criminal investigation...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.17 Images Update

New images are available for Red Hat build of Keycloak 26.0.17 and Red Hat build of Keycloak 26.0.17 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

CVE-2025-64171

A cross-namespace authorization flaw has been identified in the MARIN3R operator’s DiscoveryServiceCertificate resource. The flaw occurs because the operator mistakenly treats certain inputs as valid, bypassing Kubernetes Role-Based Access Control RBAC. When a user has permission to create...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, cadvisor, bom, maru, kubernetes-event-exporter, falcoctl, wgcf,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: spicedb-operator, gostatsd, stakater-reloader, nova, docker-machine-driver-linode, go-licenses, docker-credential-gcr, falco-no-driver, manifest-tool, scorecard, aws-s3-controller, vault-secrets-webhook, wire-go, cadvisor, bom, maru, kubernetes-event-exporter,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.1, container-object-storage-interface-fips, chisel, dragonfly-operator, wave-fips, vault-env, promxy-fips, azure-aad-pod-identity-mic, local-path-provisioner-fips, octo-sts, blob-csi, terraform-docs, gatekeeper, neuvector-dbgen-fips,...

ROS-20251030-02

A vulnerability in the NVIDIA Virtual GPU Manager component of the NVIDIA Virtual GPU driver Virtual GPU is associated with incorrectly assigning permissions to a critical resource. Exploitation of the vulnerability could allow an attacker to cause a denial of service Vulnerability in the NVIDIA...

GHSA-Q8J9-34QF-7VQ7 Silver has unrestricted traffic between Wireguard clients

Summary Sliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to: 1. Leaked/recovered keypair from a beacon being used to attack operators. 2. Port forwardings usable from other implants. Details 1. Sliver treat operators' Wireguard config and...

ROS-20251028-10

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

ROS-20251028-11

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

langchainlanggraph-checkpoint-sqlite SQL注入漏洞

langchainlanggraph-checkpoint-sqlite is an open source database connectivity Python library from LangChain. An SQL injection vulnerability exists in langchainlanggraph-checkpoint-sqlite version 2.0.10, which stems from improper handling of the filter operator and could lead to an SQL injection...

CVE-2025-47699

Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue affects Command Centre Server: 9.30 prior to...