GHSA-QVQC-4C52-X6QP vulnerabilities

Vulnerabilities for packages: kube-arangodb-fips, gpu-operator, guac, kube-arangodb, gpu-operator-fips...

CVE-2026-49349 vulnerabilities

Vulnerabilities for packages: kube-arangodb-fips, gpu-operator, guac, kube-arangodb, gpu-operator-fips...

Authorization Bypass

Apache Camel is vulnerable to Authorization Bypass. The vulnerability is due to insufficient validation of user-controlled Build resources, which allows an authorized attacker to generate Pods in arbitrary Kubernetes namespaces, including the operator namespace...

SUSE CVE-2026-47770

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion uncontrolled recursion. The crash occurs in jq's recursive...

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

GHSA-C6V2-3FFM-VCMC Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.3.3. Vulnerability Details CVEID:CVE-2026-45447 DESCRIPTION: Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: vault-fips, coder-fips, seaweedfs-rocksdb, commercial-kyverno, nemo, commercial-expanso-edge, rancher, knative-kafka-broker, chisel, prometheus, external-secrets-operator, vitess, cloudbeat-fips, skaffold, keda-fips, frankenphp-8.3, knative-kafka-broker-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: step-issuer-fips, vault-fips, act, atlantis-fips, coder-fips, argo-events-fips, eksctl, seaweedfs-rocksdb, commercial-kyverno, ko, nemo, fulcio-fips, commercial-expanso-edge, rancher, crossplane-provider-azure-powerbidedicated, helmfile, knative-kafka-broker,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: terraform-provider-acme-fips, coder-fips, crossplane-provider-aws-athena-fips, nemo, crossplane-provider-aws-organizations, commercial-expanso-edge, crossplane-provider-aws-chime, knative-kafka-broker, crossplane-provider-aws-sqs-fips, cloudflared-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: vault-fips, coder-fips, seaweedfs-rocksdb, commercial-kyverno, nemo, commercial-expanso-edge, rancher, knative-kafka-broker, chisel, prometheus, external-secrets-operator, vitess, cloudbeat-fips, skaffold, keda-fips, frankenphp-8.3, knative-kafka-broker-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: vault-fips, act, argo-events-fips, commercial-kyverno, nemo, commercial-expanso-edge, knative-kafka-broker, gomplate-fips, prometheus, prometheus-podman-exporter-fips, syft, external-secrets-operator, chainctl, vitess, splunk-otel-collector-fips, cloudbeat-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme-fips, coder-fips, crossplane-provider-aws-athena-fips, nemo, crossplane-provider-aws-organizations, commercial-expanso-edge, crossplane-provider-aws-chime, knative-kafka-broker, crossplane-provider-aws-sqs-fips, cloudflared-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: vault-fips, act, coder-fips, seaweedfs-rocksdb, argo-events-fips, commercial-kyverno, nemo, commercial-expanso-edge, rancher, knative-kafka-broker, gomplate-fips, chisel, prometheus, prometheus-podman-exporter-fips, syft, external-secrets-operator, chainctl, vitess,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: step-issuer-fips, vault-fips, act, atlantis-fips, coder-fips, argo-events-fips, eksctl, seaweedfs-rocksdb, commercial-kyverno, ko, nemo, fulcio-fips, commercial-expanso-edge, rancher, crossplane-provider-azure-powerbidedicated, helmfile, knative-kafka-broker,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: argo-cd, flux-kustomize-controller, grype, melange, crossplane-provider-azure-sql, docker, flux-source-controller, neuvector-sigstore-interface, scorecard, helm, step-issuer, steampipe, cilium-cli, nfpm, argo-events, buildkitd, vault-benchmark, cosign, tflint,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: argo-cd, src, flux-kustomize-controller, grype, melange, crossplane-provider-azure-sql, docker, flux-source-controller, neuvector-sigstore-interface, scorecard, helm, step-issuer, steampipe, tw, crossplane-provider-aws-sns, cilium-cli, nfpm, argo-events, buildkitd,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: istio, flux-source-controller, trivy-operator, kubescape, external-secrets-operator, gitlab-kas, k3s, rancher-agent, kubernetes, helm, kots, skaffold, cilium-cli, opentelemetry-collector, falco-no-driver, prometheus-operator, aactl, containerd, loki, spire-server,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: istio, buildah, rancher-agent, external-secrets-operator, k3s, gitlab-kas, kubernetes, helm, kots, podman, cilium-cli, opentelemetry-collector, falco-no-driver, prometheus-operator, aactl, containerd, loki, spire-server, mattermost, cert-manager, external-dns, flux,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: argo-cd, src, flux-kustomize-controller, grype, melange, crossplane-provider-azure-sql, docker, flux-source-controller, neuvector-sigstore-interface, scorecard, helm, step-issuer, steampipe, tw, crossplane-provider-aws-sns, cilium-cli, nfpm, argo-events, buildkitd,...