CLEANSTART-2026-GF75739 Security fixes in percona-xtradb-cluster-operator-fips 1.18.0-r5

Package percona-xtradb-cluster-operator-fips version 1.18.0-r5 fixes 9 vulnerabilities: CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-42506, CVE-2026-42502...

CLEANSTART-2026-XI30984 Security fixes in zookeeper-operator 0.2.15-r1

Package zookeeper-operator version 0.2.15-r1 fixes 3 vulnerabilities: CVE-2023-44487, CVE-2023-39325, CVE-2024-24786...

CLEANSTART-2026-YN68631 Security fixes in percona-xtradb-cluster-operator 1.19.1-r0

Package percona-xtradb-cluster-operator version 1.19.1-r0 fixes 2 vulnerabilities: ghsa-pc3f-x583-g7j2, CVE-2026-35469...

CLEANSTART-2026-GN43215 Security fixes in prometheus-operator-fips 0.88.0-r1

Package prometheus-operator-fips version 0.88.0-r1 fixes 2 vulnerabilities: CVE-2025-61732, CVE-2025-68121...

CLEANSTART-2026-QM37160 Security fixes in minio-operator-fips 7.0.1-r7

Package minio-operator-fips version 7.0.1-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-MA89802 Security fixes in minio-operator 6.0.4-r4

Package minio-operator version 6.0.4-r4 fixes 4 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp, ghsa-29wx-vh33-7x7r, CVE-2024-51744...

CLEANSTART-2026-SZ09294 Security fixes in fluent-operator-fips 3.7.0-r2

Package fluent-operator-fips version 3.7.0-r2 fixes 6 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-27140, CVE-2026-32283...

CLEANSTART-2026-LB48221 Security fixes in fluent-operator-fips 3.2.0-r7

Package fluent-operator-fips version 3.2.0-r7 fixes 10 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-33810, CVE-2026-27144, CVE-2026-32280...

CLEANSTART-2026-ND31418 Security fixes in percona-xtradb-cluster-operator 1.19.1-r1

Package percona-xtradb-cluster-operator version 1.19.1-r1 fixes 9 vulnerabilities: CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825...

CLEANSTART-2026-XN43320 Security fixes in strimzi-kafka-operator 0.51.0-r1

Package strimzi-kafka-operator version 0.51.0-r1 fixes 11 vulnerabilities: CVE-2026-2332, CVE-2026-33871, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480...

CLEANSTART-2026-MA69494 Security fixes in k8ssandra-operator-fips 3.3.0-r3

Package k8ssandra-operator-fips version 3.3.0-r3 fixes 3 vulnerabilities: CVE-2025-47907, CVE-2025-0913, CVE-2025-4673...

CLEANSTART-2026-YY15664 Security fixes in prometheus-operator 0.89.0-r2

Package prometheus-operator version 0.89.0-r2 fixes 3 vulnerabilities: CVE-2026-42504, CVE-2026-42507, CVE-2026-27145...

CLEANSTART-2026-CO71096 Security fixes in external-secrets-operator 2.8.0-r0

Package external-secrets-operator version 2.8.0-r0 fixes 1 vulnerabilities: CVE-2026-56852...

CVE-2026-44097 File Upload vulnerability

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CVE-2026-44097

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

EUVD-2026-51032

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CVE-2026-44097

The CVE-2026-44097 entry describes a low-privileged remote attacker with operator access who can upload arbitrary files through the firmware-update REST endpoint, leading to persistent attacker-controlled data and potential DoS via resource exhaustion. The root cause is an unrestricted file uploa...

CVE-2026-15240

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240

The Customer Switching WordPress plugin (versions before 2.1.3 ) contains a privilege escalation vulnerability due to insecure session binding. The plugin fails to securely link an active user-switching session to the operator who initiated it. This flaw allows a lower-privileged account—that an ...

EUVD-2026-50996

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...