CVE-2026-56816 vulnerabilities

Vulnerabilities for packages: apache-hop-fips, camunda, strimzi-kafka-operator...

GHSA-HPCC-26XQ-25FV vulnerabilities

Vulnerabilities for packages: apache-hop-fips, camunda, strimzi-kafka-operator...

CVE-2026-56816 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator...

GHSA-HPCC-26XQ-25FV vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator...

BIT-OPENBAO-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when...

MinIO Operator Console Authentication Bypass

MinIO Console is a graphical user interface for the for MinIO Operator. MinIO itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. id: CVE-2021-41266 info: name: MinIO Operator...

Windmill < 1.603.3 - Operator Authorization Bypass

Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are...

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, tetragon, istio, kubernetes-csi-external-attacher, azure-service-operator, cert-manager-istio-csr, crossplane, kubernetes-csi-external-resizer, cluster-api, helm-operator, rancher-webhook, datadog-agent, cluster-api-aws-controller, kuma,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: onepassword-operator, helm-operator, eck-operator, flux-kustomize-controller-fips, chainloop-artifact-cas, spicedb-operator, kwok, node-feature-discovery-fips, chainloop-cli, cluster-api, cloud-provider-gcp-cloud-controller-manager,...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, kube-logging-operator...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, kube-logging-operator...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...