CVE-2026-70495 Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

EUVD-2026-60361

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-70495 Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-70495

CVE-2026-70495 is a privilege escalation flaw in the search-v2-operator component of OpenShift. The search-serviceaccount is shared across 4 pods and carries overly broad permissions that allow cluster-wide impersonation of users and groups. An attacker who gains access to any pod running under t...

CVE-2026-70495

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-70495

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50770

An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

EUVD-2026-60245

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-75046

JetBrains YouTrack before 2026.2.18112 has an authenticated user enumeration flaw in the users search endpoint, allowing account discovery (CVSS 4.3 MEDIUM). No exploitation details are provided; upgrade to 2026.2.18112 or later. Monitor JetBrains issue tracker for further advisories.

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

CVE-2026-56090

Dell ObjectScale, versions prior to 4.3.0.1, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-56090

Dell ObjectScale, versions prior to 4.3.0.1, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

EUVD-2026-60201

Dell ObjectScale, versions prior to 4.3.0.1, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...