Police Bust Crypto Scammers, Nab Smishing SMS Blaster Operator

Thai police arrest SMS Blaster operator in smishing scam and bust crypto laundering gang moving $30M monthly through…...

CVE-2025-8916 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, zipkin, druid, thingsboard...

GHSA-PRJ3-CCX8-P6X4 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, tez, sonarqube, apache-pulsar, apache-nifi, akhq, apicurio-registry, celeborn, flyway, keycloak, management-api-for-apache-cassandra-5.0, strimzi-kafka-operator, trino, spark, wildfly, thingsboard, druid...

GHSA-4CX2-FC23-5WG6 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, zipkin, druid, thingsboard...

CVE-2025-55163 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, tez, sonarqube, apache-pulsar, apache-nifi, akhq, apicurio-registry, celeborn, flyway, keycloak, management-api-for-apache-cassandra-5.0, strimzi-kafka-operator, trino, spark, wildfly, thingsboard, druid...

CVE-2025-8916 vulnerabilities

Vulnerabilities for packages: druid, elasticsearch, kayenta, neo4j, elasticsearch-fips, opensearch, kserve-modelmesh, kayenta-fips, camunda-zeebe, pinot-fips, zipkin, logstash, pinot, hadoop-fips, thingsboard...

CVE-2025-55163 vulnerabilities

Vulnerabilities for packages: tez, akhq, hadoop-fips, grpc-java-fips, apache-hop-fips, thingsboard, elasticsearch, management-api-for-apache-cassandra-5.0, wildfly, camunda-zeebe, localstack, management-api-for-apache-cassandra-4.0, druid, management-api-for-apache-cassandra-4.1, celeborn,...

GHSA-4CX2-FC23-5WG6 vulnerabilities

Vulnerabilities for packages: druid, elasticsearch, kayenta, neo4j, elasticsearch-fips, opensearch, kserve-modelmesh, kayenta-fips, camunda-zeebe, pinot-fips, zipkin, logstash, pinot, hadoop-fips, thingsboard...

GHSA-PRJ3-CCX8-P6X4 vulnerabilities

Vulnerabilities for packages: tez, akhq, hadoop-fips, grpc-java-fips, apache-hop-fips, thingsboard, elasticsearch, management-api-for-apache-cassandra-5.0, wildfly, camunda-zeebe, localstack, management-api-for-apache-cassandra-4.0, druid, management-api-for-apache-cassandra-4.1, celeborn,...

UBUNTU-CVE-2025-8713

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...

CVE-2025-8713

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...

CVE-2025-55196

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

CVE-2025-55196

External Secrets Operator (github.com/external-secrets/external-secrets) contains a vulnerability in versions 0.15.0–0.19.1 where PushSecret List() calls on Kubernetes Secret and SecretStore resources ignore namespace selectors. This allows an attacker who can create or update PushSecret resource...

CVE-2025-55196 External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

CVE-2025-55196 External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret Access

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

GHSA-FCXQ-V2R3-CC8H External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access

Summary A vulnerability was discovered in the External Secrets Operator where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read...

External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access

Summary A vulnerability was discovered in the External Secrets Operator where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read...

PT-2025-33101

Name of the Vulnerable Software and Affected Versions: External Secrets Operator versions 0.15.0 through 0.19.1 Description: A flaw was discovered in the External Secrets Operator where List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply...

SUSE CVE-2025-5999

A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their own or another user's token privileges to Vault's root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22...

SUSE CVE-2025-7195

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, usersetup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used...