Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.15.0

cert-manager Operator for Red Hat OpenShift 1.15.0 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

mjolnir 安全漏洞

mjolnir is a Matrix open source auditing tool for Matrix. A security vulnerability exists in mjolnir version v1.9.0 that stems from the bot responding to administrative commands in any room, which could allow non-operator users to utilize the bot's functionality...

The vulnerability of the karmada-operator and karmadactl packages from the Kubernetes cluster management system allows a hacker to write arbitrary files to the basic file system, enabling them to run cloud applications on multiple Karmada clusters.

The vulnerability of the karmada-operator and karmadactl packages from the Kubernetes cluster management system, which are used to run cloud applications across multiple Karmada clusters, is related to an incorrect path name limitation for accessing the restricted directory. Exploiting this...

Important: Red Hat Security Advisory: VolSync 0.10.2 for RHEL 9

VolSync v0.10.2 general availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important: Red Hat Security Advisory: VolSync 0.11.1 for RHEL 9

VolSync v0.11.1 general availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

GHSA-VG7J-7CWX-8WGW Mongoose search injection vulnerability

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access...

operator-sdk-1.39.0-1.1 on GA media (moderate)

operator-sdk-1.39.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:14634-1 Rating: moderate Cross-References: CVE-2024-45338 CVE-2025-21614 CVSS scores: CVE-2024-45338 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2024-45338 SUSE : 8.2...

OPENSUSE-SU-2025:14634-1 operator-sdk-1.39.0-1.1 on GA media

These are all security issues fixed in the operator-sdk-1.39.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2023-38037 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator...

CVE-2023-38037 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator...

GHSA-Q2X7-8RV6-6Q7H vulnerabilities

Vulnerabilities for packages: emissary, checkov, airflow, mlflow, superset, kubeflow-jupyter-web-app, dask-gateway, kubeflow-volumes-web-app, kserve, py3-jinja2, kubeflow-pipelines-visualization-server, nemo, reflex, ansible-operator, apache-beam-python-3.11-sdk, localstack...

GHSA-GMJ6-6F8F-6699 vulnerabilities

Vulnerabilities for packages: emissary, checkov, airflow, mlflow, superset, kubeflow-jupyter-web-app, dask-gateway, kubeflow-volumes-web-app, kserve, py3-jinja2, nemo, reflex, ansible-operator, apache-beam-python-3.11-sdk, localstack...

CVE-2024-56201 vulnerabilities

Vulnerabilities for packages: emissary, checkov, airflow, mlflow, superset, kubeflow-jupyter-web-app, dask-gateway, kubeflow-volumes-web-app, kserve, py3-jinja2, nemo, reflex, ansible-operator, apache-beam-python-3.11-sdk, localstack...

SUSE CVE-2024-43803

The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost BMH CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespace of th...

OPENSUSE-SU-2024:0413-1 Security update for python-python-sql

This update for python-python-sql fixes the following issues: - CVE-2024-9774: Fixed that unary operators does not escape non-Expression boo1234653...

GO-2024-3349 OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather

OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3109 The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator

The Bare Metal Operator BMO can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator...

CVE-2024-25131 Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource CRD of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard...

CVE-2024-25131 Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource CRD of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard...

GHSA-W32M-9786-JP63 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, x509-certificate-exporter, spicedb, snyk-cli, cni-plugins, kube-state-metrics, cert-manager-istio-csr, grafana-agent-operator, sftpgo-plugin-auth, hubble, fulcio, stakater-reloader, kubeflow, kaniko, src,...