EUVD-2026-75782

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs...

CVE-2026-81210

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs...

CVE-2026-81210

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an IDOR combined with path traversal issue. Three caller-supplied strings are concatenated into a String.format path on the shared /ds-storage RWX PVC and the resulting file is returned with no project ACL check. Although reads are cons...

CVE-2026-72297

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after checkqos succeeds, so accepting larger values leaves invalid...

AZL-94241 CVE-2026-17527 affecting package kubevirt 1.8.4-1

In containerized-data-importer CDI, the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authoriz...

AZL-94193 CVE-2026-17527 affecting package containerized-data-importer 1.62.0-7

In containerized-data-importer CDI, the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authoriz...

MINI-V68C-V447-GPVC

Bulletin has no description...

MINI-PPVC-5C68-CF7P

Bulletin has no description...

CVE-2026-44543

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

Exploit for OS Command Injection in Kubeai

CVE-2026-34940 — OS Command Injection in KubeAI via Model URL...

CVE-2025-14459

A flaw was found in KubeVirt Containerized Data Importer CDI. This vulnerability allows a user to clone PersistentVolumeClaims PVCs from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism...

EUVD-2025-206337

A flaw was found in KubeVirt Containerized Data Importer CDI. This vulnerability allows a user to clone PersistentVolumeClaims PVCs from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism...

Red Hat OpenShift Virtualization 4 安全漏洞

Red Hat OpenShift Virtualization 4 is a virtual machine management component from Red Hat USA. A security vulnerability exists in Red Hat OpenShift Virtualization 4 that originates from unauthorized PVC cloning...

AZL-69958 CVE-2025-64433 affecting package kubevirt for versions less than 0.59.0-33

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to read arbitrary files from the virt-launcher pod's file system. This issue stems from improper symlink handling when mounting PVC disks into a VM...

CVE-2025-64433

CVE-2025-64433 affects KubeVirt prior to 1.5.3 and 1.6.1, enabling a VM to read arbitrary files from the virt-launcher pod filesystem via improper symlink handling when mounting PVCs. The issue arises when a malicious user controls PVC contents and can create a symlink to a file in the virt-launc...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, octo-sts, blobfuse2, linkerd2-proxy-init, vexctl, bank-vaults, kube-vip-cloud-provider, terraform-provider-time, pvc-autoresizer, vault-k8s, container-object-storage-interface, k8sgpt-operator, kuberay-operator, sftpgo-plugin-geoipfilter,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, octo-sts, blobfuse2, linkerd2-proxy-init, vexctl, bank-vaults, kube-vip-cloud-provider, terraform-provider-time, pvc-autoresizer, vault-k8s, container-object-storage-interface, k8sgpt-operator, kuberay-operator, sftpgo-plugin-geoipfilter,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: bank-vaults, pvc-autoresizer, nvidia-nsight-compute-12.8, sftpgo-plugin-pubsub, terraform-provider-tls-fips, etcd-fips, nvidia-nsight-compute-13.2, blob-csi-fips, addon-resizer, newrelic-fluent-bit-output, prometheus-adapter, nvidia-nsight-compute-13.1, gostatsd,...

CVE-2016-15040

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kentopvcgeo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

PVC Export Fails Due to Timeout

Challenge The export action will fail if Veeam Kasten for Kubernetes takes more than 45 minutes to complete the job. Checking the export action details, the message below is the clue where Veeam Kasten for Kubernetes hits the timeout for the operation waitWithBackoffwithRetries with the duration...