CLEANSTART-2026-AQ50460 Security fixes for CVE-2026-27145, CVE-2026-42504, CVE-2026-42507 applied in versions: 0.89.0-r2

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CM11507 Security fixes for CVE-2026-27145, CVE-2026-42504, CVE-2026-42507 applied in versions: 0.90.1-r1

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BE68531 Security fixes for CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-33814, CVE-2026-35469, CVE-2026-39821, CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-pc3f-x583-g7j2, ghsa-pjcq-xvwq-hhpj applied in versions: 1.22.0-r1

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HN09351 Security fixes for CVE-2025-61727, CVE-2025-61729, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 3.2.0-r0, 3.2.0-r1

Multiple security vulnerabilities affect the eck-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63672

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63707

Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63726

Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63714

Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-59241

Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...

PT-2026-63735

Multiple security vulnerabilities affect the gpu-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63663

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63742

Multiple security vulnerabilities affect the gpu-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63731

Multiple security vulnerabilities affect the victoriametrics-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63679

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63695

Multiple security vulnerabilities affect the eck-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-62147: Incorrect Authorization

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces...

PT-2026-63703

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63717

Multiple security vulnerabilities affect the grafana-rollout-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63700

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-59171

Summary The ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute JavaScript in the operator's browser. This affects...