CLEANSTART-2026-QR05590 Security fixes in clickhouse-operator 0.25.5-r0

Package clickhouse-operator version 0.25.5-r0 fixes 2 vulnerabilities: CVE-2025-22868, CVE-2025-22870...

CLEANSTART-2026-IM91854 Security fixes in prometheus-operator-fips 0.91.0-r0

Package prometheus-operator-fips version 0.91.0-r0 fixes 4 vulnerabilities: CVE-2026-42506, CVE-2026-42502, CVE-2026-39821, CVE-2026-27136...

CLEANSTART-2026-SZ09294 Security fixes in fluent-operator-fips 3.7.0-r2

Package fluent-operator-fips version 3.7.0-r2 fixes 6 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-27140, CVE-2026-32283...

CLEANSTART-2026-UC35253 Security fixes in fluent-operator-fips 3.7.0-r3

Package fluent-operator-fips version 3.7.0-r3 fixes 11 vulnerabilities: CVE-2026-39836, CVE-2026-33811, CVE-2026-33814, CVE-2026-42499, CVE-2026-39820...

CLEANSTART-2026-QY30309 Security fixes in minio-operator 7.1.1-r4

Package minio-operator version 7.1.1-r4 fixes 8 vulnerabilities: CVE-2026-46595, CVE-2026-42508, CVE-2026-39833, CVE-2026-39821, CVE-2026-33814...

CLEANSTART-2026-II25831 Security fixes in prometheus-operator 0.69.1-r1

Package prometheus-operator version 0.69.1-r1 fixes 29 vulnerabilities: ghsa-8rm2-7qqf-34qm, ghsa-wg65-39gg-5wfj, ghsa-vffh-x6r8-xx99, ghsa-fw8g-cg8f-9j28, CVE-2026-39820...

CLEANSTART-2026-AU93241 Security fixes in helm-operator 1.42.1-r0

Package helm-operator version 1.42.1-r0 fixes 30 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-39820, ghsa-p77j-4mvh-x3m3, CVE-2026-27143, CVE-2026-42499...

CLEANSTART-2026-RB80888 Security fixes in fluent-operator-fips 3.6.0-r5

Package fluent-operator-fips version 3.6.0-r5 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811...

CLEANSTART-2026-CW88909 Security fixes in tigera-operator 1.42.1-r1

Package tigera-operator version 1.42.1-r1 fixes 4 vulnerabilities: CVE-2026-50151, CVE-2026-50162, ghsa-vh4v-2xq2-g5cg, CVE-2026-48978...

CLEANSTART-2026-JB55968 Security fixes in prometheus-operator 0.91.0-r2

Package prometheus-operator version 0.91.0-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-CY22332 Security fixes in helm-operator 1.42.2-r1

Package helm-operator version 1.42.2-r1 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

EUVD-2026-51032

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CVE-2026-44097

The CVE-2026-44097 entry describes a low-privileged remote attacker with operator access who can upload arbitrary files through the firmware-update REST endpoint, leading to persistent attacker-controlled data and potential DoS via resource exhaustion. The root cause is an unrestricted file uploa...

CVE-2026-15240

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240 Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

EUVD-2026-50996

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240

The CVE refers to the Customer Switching for WooCommerce plugin for WordPress, affected in versions before 2.1.3. The root cause is insecure binding of an active user-switching session to the initiating operator, allowing a lower-privilege account that an operator is switched into to be resolved ...

PT-2026-66461

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client id and clien...

PT-2026-66460

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

PT-2026-66459

Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...