270636 matches found
CVE-2026-18617
A flaw was found in the Data Science Pipelines Operator DSPO. A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name DSN string. By manipulating these parameters, an attack...
CVE-2026-18608 Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide
A flaw was found in the Data Science Pipelines Operator DSPO. The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wi...
EUVD-2026-55808
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...
CVE-2026-14450 Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...
CVE-2026-14450 Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...
CVE-2026-14450
The CVE-2026-14450 issue affects the MaaS API, where any pod in the cluster can bypass the Kuadrant AuthPolicy gateway by forging HTTP headers (X-MaaS-Username and X-MaaS-Group) that are trusted verbatim. Root cause: lack of first‑party authentication between components allowing header-based auth...
CVE-2026-14450
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...
EUVD-2026-55807
A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...
CVE-2026-13717 Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)
A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...
CVE-2026-13717 Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)
A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...
CVE-2026-13717
A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...
GHSA-GX4C-2HQX-CW2R vulnerabilities
Vulnerabilities for packages: telegraf...
GHSA-GWFQ-86J8-7QHV vulnerabilities
Vulnerabilities for packages: rclone-fips, telegraf...
GHSA-945V-V9P3-V5XW vulnerabilities
Vulnerabilities for packages: telegraf...
GHSA-2M8M-JHRM-W6J2 vulnerabilities
Vulnerabilities for packages: rclone-fips, telegraf...
CVE-2026-54572 vulnerabilities
Vulnerabilities for packages: telegraf...
GHSA-8V25-V8P6-QF7V vulnerabilities
Vulnerabilities for packages: telegraf...
CVE-2026-49980 vulnerabilities
Vulnerabilities for packages: telegraf...