CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

CVE-2026-103546 Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation...

osiris

⬡ OSIRIS Open Source Intelligence & Reconnaissance Integrated System A real-time global intelligence dashboard that aggregates live flight tracking, CCTV networks, earthquake monitoring, conflict zone mapping, and 24/7 news feeds into a single GPU-accelerated interface. Live Demo · Report Bug ·...

ai-kubernetes-helm-chart-security

IA en Kubernetes: valores predeterminados de seguridad de los Helm charts evidencia Este repositorio contiene los datos y la evidencia que respaldan el informe técnico de Sorami "AI on Kubernetes: 10 of 14 Helm charts ship with no API auth" versión 1.2. Lea el informe aquí:...

CVE-2025-29557

CVE-2025-29557 – ExaGrid MailConfiguration API 凭证泄露 📝 概述 漏洞标题 ：通过 MailConfiguration API 泄露 SMTP 凭证 产品 ：ExaGrid EX10 备份设备 受影响版本 ：6.3 – 7.0.1.P08 CVE ID ：CVE-2025-29557 严重性 ：高 攻击向量 ：远程（已验证身份） 影响 ：信息泄露 – 明文 SMTP 凭证 🧨 描述 ExaGrid EX10 设备的 MailConfiguration API 端点 存在一个严重的访问控制缺陷。具有 操作员级别权限...

fusionpbx_rce_vulnerability

前言 这段简单的代码试图完整实现由Dustin Cobb在使用来电显示实现RCE – FusionPBX的多个漏洞中介绍的链式漏洞。 远程代码执行 复现步骤 1. 在Web浏览器中查看存在漏洞的操作员屏幕，本例位于 https://fusionpbxaddress/app/operatorpanel/index.php 2. 在远程系统（rcelisteneraddress）上启动一个netcat监听器.x 3. 在远程系统的另一个终端窗口中运行下面的漏洞利用代码 python3 .\main.py --closercesockets False --attackeraddress...

CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where 远程代码执行（RCE） 本仓库提供了一个可复现的漏洞环境及针对 CVE-2024-53900 的概念验证（PoC），该漏洞是 Mongoose 8.8.3 中的一个严重远程代码执行（RCE）漏洞。 📌 漏洞详情 CVE : CVE-2024-53900 受影响的版本 : Mongoose 8.8.3 严重性 : 严重（CVSS 9.1） 攻击向量 : populate.match 与 $where 结合 影响 : 在 Node.js 环境中执行任意 JavaScript（RCE） 参考资料:...

CVE-2025-59470-PostgreSQL-Command-Injection

受影响软件：PostgreSQL 15.x 早于 15.7 的版本，16.x 早于 16.3 的版本。 漏洞类型：pgbackup 扩展中的命令注入。 描述：pgbackup 扩展未能正确清理用户提供的参数，使得备份操作员能够注入任意命令，这些命令将以 PostgreSQL 用户身份执行。...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: keycloak, apache-tika, apache-nifi, wildfly, opensearch, scala, sonarqube, druid, keycloak-config-cli, tez, logstash, trino, strimzi-kafka-operator, spark, akhq, cass-config-builder, gradle, spdx-tools-java, infinispan, apache-nifi-registry, flyway, dependency-track,...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: keycloak, apache-tika, apache-nifi, wildfly, opensearch, scala, sonarqube, druid, keycloak-config-cli, tez, logstash, trino, strimzi-kafka-operator, spark, akhq, cass-config-builder, gradle, spdx-tools-java, infinispan, apache-nifi-registry, flyway, dependency-track,...

PT-2026-104557

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules CSM Operator versions prior to 1.18.0 Description An improper privilege management issue exists in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this flaw t...

CVE-2026-104055

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: akhq, apache-pulsar-fips, celeborn, wso2is, logstash, apache-pulsar, cruise-control, drain-cleaner, nuxeo, spark-fips, flink-kubernetes-operator, keycloak-config-cli, spark, logstash-fips, thingsboard, kafbat-ui, cassandra-reaper, hadoop-client-modules,...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: akhq, apache-pulsar-fips, celeborn, wso2is, logstash, apache-pulsar, cruise-control, drain-cleaner, nuxeo, spark-fips, flink-kubernetes-operator, keycloak-config-cli, spark, logstash-fips, thingsboard, kafbat-ui, cassandra-reaper, hadoop-client-modules,...

GHSA-P6PP-M3F8-5C89 vulnerabilities

Vulnerabilities for packages: akhq, apache-pulsar-fips, celeborn, wso2is, logstash, apache-pulsar, cruise-control, drain-cleaner, nuxeo, spark-fips, flink-kubernetes-operator, keycloak-config-cli, spark, logstash-fips, thingsboard, kafbat-ui, cassandra-reaper, hadoop-client-modules,...

CVE-2026-89407 vulnerabilities

Vulnerabilities for packages: akhq, apache-pulsar-fips, celeborn, wso2is, logstash, apache-pulsar, cruise-control, drain-cleaner, nuxeo, spark-fips, flink-kubernetes-operator, keycloak-config-cli, spark, logstash-fips, thingsboard, kafbat-ui, cassandra-reaper, hadoop-client-modules,...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: wildfly, wavefront-proxy, opensearch, jenkins-plugin-manager, strimzi-kafka-oauth, sonarqube, druid, keycloak-config-cli, tez, logstash, management-api-for-apache-cassandra-5.0, neo4j, celeborn, strimzi-kafka-operator, spark, akhq, thingsboard, cass-config-builder,...

GHSA-P6PP-M3F8-5C89 vulnerabilities

Vulnerabilities for packages: wildfly, wavefront-proxy, opensearch, jenkins-plugin-manager, strimzi-kafka-oauth, sonarqube, druid, keycloak-config-cli, tez, logstash, management-api-for-apache-cassandra-5.0, neo4j, celeborn, strimzi-kafka-operator, spark, akhq, thingsboard, cass-config-builder,...