PT-2026-34176

Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions prior to 1.11.1 Description A validation bypass in the VolumeMount path restriction allows mounting volumes under restricted '/tekton/' internal paths by using '..' path traversal components. The restriction check use...

Tekton Pipelines 安全漏洞

Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. There are security vulnerabilities in versions 0.43.0 to 1.11.0 of Tekton Pipelines. These vulnerabilities stem from improper regular expression matching, which could allow attackers to bypass resource verification...

GHSA-5PV2-86QJ-5JF9 Cockpit has NoSQL Injection Through Content Aggregation Pipelines

A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack...

Giskard Has A Regular Expression Denial Of Service (ReDoS) In RegexMatching Check

Summary The RegexMatching check in the "giskard-checks" package passes a user-supplied regular expression pattern directly to Python's re.search without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: argo-rollouts, argocd-image-updater, argo-workflows, argo-cd, kube-arangodb, postgres-operator, verticadb-operator, sonobuoy, cloudnative-pg, consul-k8s, headlamp, k8sgpt-operator, emissary, kubernetes, istio, k3s, kargo, kubernetes-dashboard-api, teleport, kubevela,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: argo-rollouts, argocd-image-updater, argo-workflows, argo-cd, kube-arangodb, postgres-operator, verticadb-operator, sonobuoy, cloudnative-pg, consul-k8s, headlamp, k8sgpt-operator, emissary, kubernetes, istio, k3s, kargo, kubernetes-dashboard-api, teleport, kubevela,...

GHSA-R4Q5-VMMM-2653 vulnerabilities

Vulnerabilities for packages: code-server, lerna, argo-workflows, opensearch-dashboards, thingsboard, saf, langfuse, kubeflow-katib, prism, kubeflow-pipelines, nextcloud-server, configurable-http-proxy...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes-fips, kubescape, longhorn-cli-fips, teleport, kiali-fips, headlamp, aws-node-termination-handler-fips, plugin-barman-cloud, neuvector-fips, datadog-agent-fips, falcoctl, velero-fips, skaffold-fips, cloudnative-pg-fips, kots, kube-arangod...

CVE-2026-40288

PraisonAI and praisonaiagents prior to versions 4.5.139 and 1.5.140 are exposed to a critical RCE via untrusted workflow YAML. When a YAML file for type: job is loaded, the JobWorkflowExecutor (job_workflow.py) processes steps allowing run (subprocess.run), script (inline Python via exec), and py...

PT-2026-32983

Name of the Vulnerable Software and Affected Versions Giskard versions prior to 1.0.2b1 Description The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to the Python re.search function without a timeout, complexity guard, or pattern...

GHSA-3P68-RC4W-QGX5 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, kubeflow-centraldashboard, lerna, saf, langfuse, kubeflow-katib, prism, kubeflow-pipelines, jitsucom-jitsu, nextcloud-server...

CVE-2025-62718 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, kubeflow-centraldashboard, lerna, saf, langfuse, kubeflow-katib, prism, kubeflow-pipelines, jitsucom-jitsu, nextcloud-server...

CVE-2025-62718 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, kibana, librechat, langfuse-fips, awx, opensearch-dashboards, redisinsight, langfuse, kubeflow-katib, wazuh-dashboard, gitlab-rails-ce-fips, saf, gitlab-rails-ce, opensearch-dashboards-fips, lerna, kubeflow-pipelines, nextcloud-server,...

GHSA-3P68-RC4W-QGX5 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, kibana, librechat, langfuse-fips, awx, opensearch-dashboards, redisinsight, langfuse, kubeflow-katib, wazuh-dashboard, gitlab-rails-ce-fips, saf, gitlab-rails-ce, opensearch-dashboards-fips, lerna, kubeflow-pipelines, nextcloud-server,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: open-webui, mycli, ggshield, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, jupyter-base-notebook, superset, airflow, py3-cassandra-medusa, kserve, in-toto, semgrep, k8s-sidecar, kubeflow-jupyter-web-app, datadog-agent, mitmproxy, dask-kubernetes...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: open-webui, mycli, ggshield, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, jupyter-base-notebook, superset, airflow, py3-cassandra-medusa, kserve, in-toto, semgrep, k8s-sidecar, kubeflow-jupyter-web-app, datadog-agent, mitmproxy, dask-kubernetes...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: localstack, authentik, metaflow-service, kubeflow-volumes-web-app, py3-cassandra-medusa, barman, semgrep, datadog-agent-fips, pgadmin4, apache-beam-python-3.12-sdk, nemo, ggshield, in-toto, openstack-kolla-toolbox-2025.2, jupyter-base-notebook, airflow, mitmproxy,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: localstack, authentik, metaflow-service, kubeflow-volumes-web-app, py3-cassandra-medusa, barman, semgrep, datadog-agent-fips, pgadmin4, apache-beam-python-3.12-sdk, nemo, ggshield, in-toto, openstack-kolla-toolbox-2025.2, jupyter-base-notebook, airflow, mitmproxy,...

PT-2026-31719

Name of the Vulnerable Software and Affected Versions versions not specified Description A remote attacker with low privileges can manipulate Modbus register values used in odorant injection logic, potentially causing over or under-injection of odorant into a gas line. Attackers have exploited th...

Signals from the Cloud Security Forecast 2026: Cloud Risk Is Scaling through Design, Not Disruption

Key Takeaways Identity and permissions now determine what is reachable, making them the primary drivers of cloud risk. Runtime exposure, not individual findings, determines how low-risk issues combine into real impact. SaaS and OAuth integrations extend the control plane and amplify blast radius...