CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: cinc-auditor, kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: cinc-auditor, kube-logging-operator...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: cinc-auditor, kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

renovate-operator v5.4.0

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...

CVE-2026-54696 vulnerabilities

Vulnerabilities for packages: cinc-auditor, ruby3.2-fluentd-kubernetes-daemonset, pghero, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, kube-logging-operator, logstash, gitlab-rails-ce-fips, pact-broker-docker, commercial-gitlab-rails-ee, pghero-fips...

CVE-2026-54171 vulnerabilities

Vulnerabilities for packages: cinc-auditor, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, kube-logging-operator, gitlab-rails-ce-fips, commercial-gitlab-rails-ee...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: cinc-auditor, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, kube-logging-operator, gitlab-rails-ce-fips, commercial-gitlab-rails-ee...

GHSA-X2F5-4PRF-W687 vulnerabilities

Vulnerabilities for packages: cinc-auditor, ruby3.2-fluentd-kubernetes-daemonset, pghero, commercial-gitlab-rails-ee-fips, gitlab-rails-ce, kube-logging-operator, logstash, gitlab-rails-ce-fips, pact-broker-docker, commercial-gitlab-rails-ee, pghero-fips...

GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

EUVD-2026-48612

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006

lakeFS

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

PT-2026-64319

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.83.0 commit 71a45ee Description An authentication bypass exists in the '/setup comm prefs' endpoint. This allows unauthenticated attackers to overwrite operator metadata, such as email, name, and company, after the...

PT-2026-71710

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.10 Mongoose versions prior to 7.8.10 Mongoose versions prior to 8.24.1 Mongoose versions prior to 9.7.2 Description Passing user-controlled updates to functions like updateOnefilter, req.body can lead to prototy...

CVE-2026-66006: Missing Authentication for Critical Function

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...