GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator, pact-broker-docker, pghero, logstash...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: pghero-fips, ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator, pact-broker-docker, pghero, logstash...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

EUVD-2026-48612

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006

lakeFS

PT-2026-64319

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.83.0 commit 71a45ee Description An authentication bypass exists in the '/setup comm prefs' endpoint. This allows unauthenticated attackers to overwrite operator metadata, such as email, name, and company, after the...

EUVD-2026-48426

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724

Nebula-Mesh (pre-0.3.4) suffers an authorization gap: the /api/v1/* surface largely trusts bearer tokens and enforces ownership only for the Web layer, leaving host, network, firewall, mobile-bundle, and most operator endpoints vulnerable to cross-tenant access. This enables privilege escalation ...

GHSA-GG3M-VVP2-P2C5 vulnerabilities

Vulnerabilities for packages: azurefile-csi, istio, containerd, flux-source-controller, snyk-cli, argo-cd, kitty, loki, crossplane-provider-keycloak, vexctl, helm-operator, aws-nuke, kyverno-policy-reporter, grafana-alloy, terraform-provider-azapi, flux-image-automation-controller, elvish, kubo,...

CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: azurefile-csi, istio, containerd, flux-source-controller, snyk-cli, argo-cd, kitty, loki, crossplane-provider-keycloak, vexctl, helm-operator, aws-nuke, kyverno-policy-reporter, grafana-alloy, terraform-provider-azapi, flux-image-automation-controller, elvish, kubo,...