SpiceDB security vulnerabilities

SpiceDB is a fine-grained permissions database from the Authzed team. A security vulnerability exists in SpiceDB versions prior to 1.45.2, which stems from a write relation call not being handled correctly when using the exclude operator, which could lead to incorrect permission check results...

FBI Wants to Know Who Runs Archive.ph

The FBI has issued a federal subpoena to domain registrar Tucows, demanding extensive billing and session records to unmask the anonymous operator of Archive.ph Archive.is and Archive.today. The site, known for bypassing paywalls, is now the subject of an undisclosed criminal investigation...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.17 Images Update

New images are available for Red Hat build of Keycloak 26.0.17 and Red Hat build of Keycloak 26.0.17 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

CVE-2025-64171

A cross-namespace authorization flaw has been identified in the MARIN3R operator’s DiscoveryServiceCertificate resource. The flaw occurs because the operator mistakenly treats certain inputs as valid, bypassing Kubernetes Role-Based Access Control RBAC. When a user has permission to create...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: runc, kwok, minio-object-browser, etcd, cfssl, docker-machine-driver-harvester, direnv, iptables-wrappers, opensearch-k8s-operator, secrets-store-csi-driver-provider-gcp, thanos-operator, cluster-api-helm-controller, velero, policy-controller, rancher-helm, glow,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: runc, kwok, minio-object-browser, etcd, cfssl, docker-machine-driver-harvester, direnv, iptables-wrappers, opensearch-k8s-operator, thanos-operator, cluster-api-helm-controller, velero, policy-controller, rancher-helm, glow, gcsfuse, custom-pod-autoscaler, lazydocker...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: runc, kwok, minio-object-browser, etcd, cfssl, docker-machine-driver-harvester, direnv, iptables-wrappers, opensearch-k8s-operator, secrets-store-csi-driver-provider-gcp, cluster-api-helm-controller, velero, policy-controller, rancher-helm, glow, gcsfuse,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: runc, kwok, minio-object-browser, etcd, cfssl, docker-machine-driver-harvester, direnv, iptables-wrappers, opensearch-k8s-operator, secrets-store-csi-driver-provider-gcp, thanos-operator, cluster-api-helm-controller, velero, policy-controller, rancher-helm, glow,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: runc, kwok, minio-object-browser, etcd, cfssl, docker-machine-driver-harvester, direnv, iptables-wrappers, opensearch-k8s-operator, secrets-store-csi-driver-provider-gcp, thanos-operator, cluster-api-helm-controller, velero, policy-controller, rancher-helm, glow,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: runc, kwok, minio-object-browser, etcd, cfssl, docker-machine-driver-harvester, direnv, iptables-wrappers, opensearch-k8s-operator, secrets-store-csi-driver-provider-gcp, thanos-operator, cluster-api-helm-controller, velero, policy-controller, rancher-helm, glow,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: crossplane-function-go-templating, terraform-provider-kubernetes-fips, harbor, gcp-compute-persistent-disk-csi-driver-fips, contour, kiam, grpc-health-probe-fips, kube-rbac-proxy, lazydocker, rancher-loglevel, knative-serving, ansible-operator, ucd, kuberlr, xeol-fip...

ROS-20251030-02

A vulnerability in the NVIDIA Virtual GPU Manager component of the NVIDIA Virtual GPU driver Virtual GPU is associated with incorrectly assigning permissions to a critical resource. Exploitation of the vulnerability could allow an attacker to cause a denial of service Vulnerability in the NVIDIA...

GHSA-Q8J9-34QF-7VQ7 Silver has unrestricted traffic between Wireguard clients

Summary Sliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to: 1. Leaked/recovered keypair from a beacon being used to attack operators. 2. Port forwardings usable from other implants. Details 1. Sliver treat operators' Wireguard config and...

ROS-20251028-11

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

CVE-2025-12103: Incorrect Privilege Assignment

A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role trustyai-service-operator-lmeval-user-role and a CRB...

ROS-20251028-10

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

langchainlanggraph-checkpoint-sqlite SQL injection vulnerability

langchainlanggraph-checkpoint-sqlite is an open source database connectivity Python library from LangChain. An SQL injection vulnerability exists in langchainlanggraph-checkpoint-sqlite version 2.0.10, which stems from improper handling of the filter operator and could lead to an SQL injection...