EUVD-2026-20954

Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll causes the orWhereNotNull'usergroupid' clause to escape the ownership filter applied by the when block. Any authenticated non-admin user with upload permission who owns...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, conftest, k8ssandra-client, restic, crossplane-provider-aws-sqs, zarf, istio, kubeflow-pipelines, pulumi-kubernetes-operator, telegraf, cosign, boring-registry, ratify, cluster-api-aws-controller, gogatekeeper,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: aws-fsx-csi-driver, kubernetes-csi-external-snapshotter, crossplane-provider-aws-osis-fips, kubevirt-cdi-uploadserver, beats-fips, dgraph, crossplane-function-patch-and-transform-fips, kubernetes-dns-node-cache-fips, external-secrets-operator,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: aws-fsx-csi-driver, kubernetes-csi-external-snapshotter, crossplane-provider-aws-osis-fips, kubevirt-cdi-uploadserver, beats-fips, dgraph, crossplane-function-patch-and-transform-fips, kubernetes-dns-node-cache-fips, external-secrets-operator,...

CLEANSTART-2026-SQ18258 url

Multiple security vulnerabilities affect the minio-operator-fips package. url. See references for individual vulnerability details...

CLEANSTART-2026-BA09462 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Multiple security vulnerabilities affect the cass-operator-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-UF78567 net/url package does not set a limit on the number of query parameters in a query

Multiple security vulnerabilities affect the minio-operator-fips package. The net/url package does not set a limit on the number of query parameters in a query. See references for individual vulnerability details...

CLEANSTART-2026-UQ00642 Docker CLI for Windows searches for plugin binaries in C:\\ProgramData\\Docker\\cli-plugins, a directory that does not exist by default

Multiple security vulnerabilities affect the minio-operator-fips package. Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. See references for individual vulnerability details...

CLEANSTART-2026-ST75560 During the TLS 1

Multiple security vulnerabilities affect the minio-operator-fips package. During the TLS 1. See references for individual vulnerability details...

CLEANSTART-2026-OT38160 url

Multiple security vulnerabilities affect the minio-operator-fips package. url. See references for individual vulnerability details...

CLEANSTART-2026-HZ73294 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Multiple security vulnerabilities affect the kube-fluentd-operator package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. See references for individual...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.22 contained security vulnerabilities. These vulnerabilities stemmed from allowing attackers with the operator.read scope to expose credentials, potentially leading to informati...

PT-2026-31778

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25 Description OpenClaw contains a privilege escalation issue in the gateway plugin subagent's deleteSession function. This function utilizes a synthetic operator.admin runtime scope, allowing attackers to...

Aiven Operator 安全漏洞

Aiven Operator is an open-source Kubernetes cluster management service developed by Aiven. Versions of Aiven Operator from 0.31.0 to 0.37.0 contained a security vulnerability. This vulnerability stemmed from the operator trusting the namespace values provided by users without verification. As a...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.22 contained security vulnerabilities. These vulnerabilities stemmed from the lack of enforcement of the operator.admin scope for mutated internal ACP chat commands, which could...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.25 contained security vulnerabilities. These vulnerabilities stemmed from improper access control in the HTTP /sessions/:sessionKey/kill route. As a result, any user with a toke...

PT-2026-31659

Name of the Vulnerable Software and Affected Versions Aiven Operator versions 0.31.0 through 0.36.9 Description Aiven Operator allows provisioning and management of Aiven Services from a Kubernetes cluster. A developer with create permission on ClickhouseUser Custom Resource Definitions CRDs in...

GHSA-XMRV-PMRH-HHX2 vulnerabilities

Vulnerabilities for packages: tfsec, keda, beats-fips, crossplane-provider-aws-firehose, crossplane-provider-family-aws, k9s, loki, crossplane-provider-aws-ecs-fips, crossplane-aws-provider-fips, aws-nuke-fips, grafana-mimir, terragrunt-fips, rekor-fips, vault, packer, aws-network-policy-agent,...

CLEANSTART-2026-TI57220 url

Multiple security vulnerabilities affect the prometheus-operator package. url. See references for individual vulnerability details...

Addressable has a Regular Expression Denial of Service in Addressable templates

Impact Within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic backtracking: 1. Templates using the explode modifier with any expansion operator e.g., foo, +var, var, /var, .var, ;var, ?var, &var generate patterns...