59752 matches found
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...
GHSA-HPCC-26XQ-25FV vulnerabilities
Vulnerabilities for packages: spark-fips, opensearch-fips, camunda-zeebe, apache-hop, apache-hop-fips, strimzi-kafka-operator-fips, opensearch, spark, strimzi-kafka-operator, camunda...
CVE-2026-56816 vulnerabilities
Vulnerabilities for packages: spark-fips, opensearch-fips, camunda-zeebe, apache-hop, apache-hop-fips, strimzi-kafka-operator-fips, opensearch, spark, strimzi-kafka-operator, camunda...
GHSA-HPCC-26XQ-25FV vulnerabilities
Vulnerabilities for packages: opensearch, strimzi-kafka-operator, spark...
CVE-2026-56816 vulnerabilities
Vulnerabilities for packages: opensearch, strimzi-kafka-operator, spark...
BIT-OPENBAO-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: rancher-system-agent, k3s, descheduler, apisix-ingress-controller, kube-state-metrics, hubble-ui, cert-manager-istio-csr, kubernetes-csi-external-health-monitor, kubescape-operator, kubernetes-csi-external-resizer, kyverno, rke2-cloud-provider,...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: datadog-agent-fips, flux-operator-fips, opentelemetry-operator, opentelemetry-operator-fips, cluster-api-provider-vsphere, tekton-pipelines-fips, cilium-fips, cloud-provider-vsphere, tekton-chains-fips, telegraf, livekit-cli, rancher-agent, ceph-csi-operator, tkn-fip...
CVE-2026-54171 vulnerabilities
Vulnerabilities for packages: cinc-auditor, kube-logging-operator...
CVE-2026-54696 vulnerabilities
Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator...
GHSA-48RX-C7PG-Q66R vulnerabilities
Vulnerabilities for packages: cinc-auditor, kube-logging-operator...
GHSA-X2F5-4PRF-W687 vulnerabilities
Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator...
Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL
Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...
CVE-2026-54696 vulnerabilities
Vulnerabilities for packages: pact-broker-docker, logstash, pghero, ruby3.2-fluentd-kubernetes-daemonset, pghero-fips, kube-logging-operator...
CVE-2026-54171 vulnerabilities
Vulnerabilities for packages: cinc-auditor, kube-logging-operator...
GHSA-X2F5-4PRF-W687 vulnerabilities
Vulnerabilities for packages: pact-broker-docker, logstash, pghero, ruby3.2-fluentd-kubernetes-daemonset, pghero-fips, kube-logging-operator...
GHSA-48RX-C7PG-Q66R vulnerabilities
Vulnerabilities for packages: cinc-auditor, kube-logging-operator...
GHSA-MVX4-532P-XFM9 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation
Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...
CVE-2026-66006
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...
CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...