59718 matches found
CVE-2026-47726
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
EUVD-2026-49942
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
CVE-2026-47726
CVE-2026-47726 (nebula-mesh) affects nebula-mesh prior to v0.3.2. The handleGetAuditLog endpoint in internal/api/audit.go does not enforce an admin check, allowing any operator API key with bearer authentication to retrieve the full audit log via store.ListAuditEntries (limit 1000). Exposed data ...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...
CVE-2026-56816 vulnerabilities
Vulnerabilities for packages: opensearch, opensearch-fips, apache-hop-fips, strimzi-kafka-operator-fips, strimzi-kafka-operator, spark, camunda-zeebe, apache-hop, camunda, spark-fips...
GHSA-HPCC-26XQ-25FV vulnerabilities
Vulnerabilities for packages: opensearch, opensearch-fips, apache-hop-fips, strimzi-kafka-operator-fips, strimzi-kafka-operator, spark, camunda-zeebe, apache-hop, camunda, spark-fips...
GHSA-HPCC-26XQ-25FV vulnerabilities
Vulnerabilities for packages: spark, strimzi-kafka-operator, opensearch...
CVE-2026-56816 vulnerabilities
Vulnerabilities for packages: spark, strimzi-kafka-operator, opensearch...
BIT-OPENBAO-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: flux-kustomize-controller, spqr, keda, tekton-pipelines, cloud-provider-aws, external-secrets-operator, rancher-system-agent, kubernetes-csi-external-health-monitor, cluster-api-aws-controller, cloud-provider-vsphere, cert-manager-webhook-pdns,...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: kueue, metallb-fips, calico-fips, cloud-provider-gcp-cloud-controller-manager-fips, crossplane-function-auto-ready, kubernetes-csi-external-resizer, commercial-grafana, open-cluster-management-fips, gitlab-kas-fips, external-secrets-fips, nginx-kubernetes-ingress-fip...
CVE-2026-54696 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...
CVE-2026-54171 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, cinc-auditor...
GHSA-48RX-C7PG-Q66R vulnerabilities
Vulnerabilities for packages: kube-logging-operator, cinc-auditor...
GHSA-X2F5-4PRF-W687 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...
Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL
Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...