CVE-2026-54901 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset...

GHSA-3V45-F3VH-WG7M vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, kube-logging-operator, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset...

GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: traefik, nfpm, crossplane-provider-azure-alertsmanagement, gobuster, crossplane-provider-azure-network, crossplane-provider-azure-servicenetworking, crossplane-provider-azure-operationalinsights, crossplane-provider-azure-search, crossplane-provider-azure-relay,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: flux-source-controller, frankenphp-8.5, kubescape-server-fips, prometheus-operator, nemo, kine, zarf-fips, grafana-fips, zitadel, keda-fips, osv-scanner, frankenphp-8.4, prometheus-fips, gitlab-kas, trivy-operator, minio-fips, loki, etcd-fips, gitea, reports-server,...

GHSA-M2V9-299J-RV96 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: istio, containerd, flux-source-controller, nuclei, snyk-cli, argo-cd, datadog-agent, opentofu, loki, knative-serving, dagger, guac, gitlab-runner, k9s, osv-scanner, act, chisel, apko, trivy-operator, trivy, witness, flux-image-automation-controller, kots, rootlesskit...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: kots, external-secrets-operator, kubernetes, cilium-cli, istio, prometheus, containerd, flux-source-controller, snyk-cli, argocd-image-updater, opentelemetry-collector, cert-manager, cilium, skaffold, k3s, kubernetes-dashboard, kyverno, helm, telegraf, gitlab-kas,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: istio, containerd, flux-source-controller, nuclei, snyk-cli, argo-cd, opentofu, loki, knative-serving, dagger, guac, k9s, osv-scanner, act, apko, trivy-operator, trivy, witness, flux-image-automation-controller, kots, nfpm, k3s, kubernetes-dashboard, kyverno, buildah...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: k8sgpt, istio, containerd, flux-source-controller, nuclei, snyk-cli, atlantis, argo-cd, datadog-agent, opentofu, neuvector-sigstore-interface, loki, knative-serving, dagger, fulcio, guac, gitlab-runner, k9s, osv-scanner, act, chisel, apko, sops,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kots, external-secrets-operator, kubernetes, cilium-cli, istio, prometheus, containerd, flux-source-controller, snyk-cli, argocd-image-updater, opentelemetry-collector, cert-manager, cilium, skaffold, k3s, kubernetes-dashboard, kyverno, helm, telegraf, gitlab-kas,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: istio, containerd, flux-source-controller, nuclei, snyk-cli, argo-cd, datadog-agent, opentofu, loki, knative-serving, dagger, guac, gitlab-runner, k9s, osv-scanner, act, chisel, apko, trivy-operator, trivy, witness, flux-image-automation-controller, kots, rootlesskit...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: k8sgpt, istio, containerd, flux-source-controller, nuclei, snyk-cli, atlantis, argo-cd, crossplane-provider-aws-cloudwatchlogs, datadog-agent, opentofu, neuvector-sigstore-interface, crossplane-provider-aws-memorydb, gitlab-pages, knative-serving, loki, dagger,...

CVE-2026-44735

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

CVE-2026-44735

Technical details for CVE-2026-44735 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-44735 OpenProject: Shares API Information Disclosure

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

CVE-2026-44735 OpenProject: Shares API Information Disclosure

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libtiff: libtiff-4.7.1-2.2.hum1 aarch64, x8664 libtiff-devel-4.7.1-2.2.hum1 aarch64, x8664 libtiff-static-4.7.1-2.2.hum1 aarch64, x8664 libtiff-tools-4.7.1-2.2.hum1 aarch64, x8664...

CVE-2026-44736 OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject title of work packages they have no permission to view — by supplying an arbitrary work package ID in the...

CVE-2026-44736 OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject title of work packages they have no permission to view — by supplying an arbitrary work package ID in the...

CVE-2026-52781 OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data- attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount ...