PT-2026-104440

Name of the Vulnerable Software and Affected Versions postgresql-operator charm versions prior to 1189 arm64 and 1190 amd64 in the dev track 14/edge postgresql-operator charm versions prior to 1216 arm64 and 1217 amd64 in the stable track 14/stable Description The postgresql-operator charm utiliz...

GHSA-8988-9CW3-XX77 vulnerabilities

Vulnerabilities for packages: openstack-barbican-2025.2, openstack-manila-2025.2, openstack-horizon-2025.2, openstack-ceph-config-helper-2026.1, apache-beam-python-3.13-sdk, py3-cassandra-medusa, openstack-placement-2025.1-fips, presidio-analyzer, openstack-cinder-2026.1,...

GHSA-VXQ7-64XX-V4GW vulnerabilities

Vulnerabilities for packages: openstack-barbican-2025.2, openstack-manila-2025.2, openstack-horizon-2025.2, openstack-ceph-config-helper-2026.1, apache-beam-python-3.13-sdk, py3-cassandra-medusa, openstack-placement-2025.1-fips, presidio-analyzer, openstack-cinder-2026.1,...

GHSA-GH4C-6FX4-QH6G vulnerabilities

Vulnerabilities for packages: openstack-barbican-2025.2, openstack-manila-2025.2, openstack-horizon-2025.2, openstack-ceph-config-helper-2026.1, apache-beam-python-3.13-sdk, py3-cassandra-medusa, openstack-placement-2025.1-fips, presidio-analyzer, openstack-cinder-2026.1,...

CVE-2026-97689 vulnerabilities

Vulnerabilities for packages: openstack-barbican-2025.2, openstack-manila-2025.2, openstack-horizon-2025.2, openstack-ceph-config-helper-2026.1, apache-beam-python-3.13-sdk, py3-cassandra-medusa, openstack-placement-2025.1-fips, presidio-analyzer, openstack-cinder-2026.1,...

GO-2026-6590 OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator

OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

CVE-2026-55396

The Teledyne FLIR Aware2 software, specifically in versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) , is vulnerable to the cleartext transmission of UDP traffic from the operator control unit to the robot. Because this traffic lacks a cryptographic integrity check , adjacent unauthenticat...

Important: Red Hat Security Advisory: Cluster Observability Operator 1.5.3

The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5.3 release of COO...

BIT-PARSE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

ruby:2.5 security update

An update is available for rubygem-abrt, module.rubygem-bundler, module.rubygem-bson, ruby, rubygem-mysql2, module.rubygem-abrt, rubygem-pg, module.rubygem-mongo, module.rubygem-pg, module.rubygem-mysql2, rubygem-bson, module.ruby, rubygem-mongo, rubygem-bundler. This update affects Rocky Linux 8...

PT-2026-105817

Summary When plaintext passwords are stored in AUTH ACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character. Details python lightrag/api/passwords.py:13-26 def...

Homomorphic Advantage Operator: Stabilizing Reinforcement Learning under Fully Homomorphic Encryption Constraints

Privacy-preserving machine learning presents significant deployment challenges on the cloud for intelligent systems with confidential data. Fully Homomorphic Encryption FHE offers a compelling solution for secure computation, preserving data confidentiality of cloud computations. However, applyin...

PT-2026-104015

Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.3 PackBot Teledyne FLIR Aware2 versions prior to 1.7.10 FirstLook Description UDP traffic between the operator control unit and the robot is transmitted in cleartext without a cryptographic integrit...

PT-2026-105607

OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

Important: Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update

An updated OpenShift File Integrity Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift File Integrity Operator v1.5.0 is now available. See the documentation for bug fix information:...

rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection

A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...

Important: Red Hat Security Advisory: ruby:2.5 security update

An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

EUVD-2026-89959

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CVE-2026-101295

The oc-mirror tool is vulnerable to a path traversal and arbitrary file write flaw during the operator catalog image extraction process. When users mirror operator catalogs using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), the software fails to validate that extracted t...