CVE-2026-75843 ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

BIT-ETCD-2026-73499 etcd: Watch API authorization bypass via open-ended range requests

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-70495

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-70495 Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

EUVD-2026-60361

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-72656

A flaw was found in Elasticsearch. An authenticated user, by submitting a specially crafted ES|QL query, could trigger an unbounded allocation of heap memory. This excessive memory consumption exhausts the available resources on the receiving node, leading to a denial of service DoS condition whe...

CVE-2026-15218

The maas-api and maas-controller ServiceAccounts in Red Hat OpenShift AI (Models-as-a-Service) are granted excessive cluster-wide permissions. An attacker who compromises these identities via RCE or a malicious pod can escalate to full cluster admin by creating ClusterRoleBindings or read all clu...

CVE-2026-15218 Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2025-3690 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator, seaweedfs-operator-fips...

GO-2024-2536 vulnerabilities

Vulnerabilities for packages: rancher-webhook...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2024-3002 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2025-3994 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: trivy, flux-kustomize-controller, docker, scorecard, crossplane-provider-aws-dynamodb, kubeflow, prometheus-redis-exporter, pulumi-language-dotnet, doppler-kubernetes-operator, rabbitmq-cluster-operator, grpcurl, slsa-verifier, gitness, k8ssandra-operator,...

GO-2025-3521 vulnerabilities

Vulnerabilities for packages: vcluster, kubernetes...

GO-2020-0012 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-4736 vulnerabilities

Vulnerabilities for packages: kube-vip, cilium-cli...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dbmate, kaniko, hubble-ui, kubernetes-csi-driver-hostpath, kube-rbac-proxy, kots, vcluster, terraform-provider-google, certificate-transparency, k8sgpt, smarter-device-manager, restic, spegel, guac, kubernetes-csi-external-provisioner, kargo, k3s, k8sgpt-operator,...