CVE-2026-15063

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-15044

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the...

CVE-2026-15063 Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-15063

The CVE-2026-15063 affects the gorch service in the trustyai-service-operator. The issue is that, even with authentication enabled, gorch exposes unproxied orchestrator and detector metrics ports, reachable from any pod on the cluster network. This bypasses kube-rbac-proxy authentication, enablin...

CVE-2026-15044 Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the...

EUVD-2026-42283

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these services can expose their communication channels without requiring users to prove their identity. This allows any other program within the...

CVE-2026-15044

The CVE concerns the TrustyAI Service Operator. In deployments of services such as gorch and NemoGuardrails, if a specific security setting is not enabled, communication channels can be exposed without requiring user authentication, allowing any other program in the cluster to access the AI guard...

PT-2026-56458

Name of the Vulnerable Software and Affected Versions TrustyAI Service Operator affected versions not specified Description A flaw in the TrustyAI Service Operator occurs when deploying services such as gorch or NemoGuardrails. If a specific security setting is not enabled, these services expose...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, crossplane-provider-aws-sqs-fips, cyberark-secrets-provider-for-k8s, linkerd2, percona-backup-mongodb, cert-manager-cmctl-fips, distribution, crossplane-provider-aws-cloudwatchevents-fips, crossplane-provider-azure-servicelinker,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, crossplane-provider-aws-sqs-fips, cyberark-secrets-provider-for-k8s, linkerd2, percona-backup-mongodb, cert-manager-cmctl-fips, distribution, crossplane-provider-aws-cloudwatchevents-fips, crossplane-provider-azure-servicelinker,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: falcosidekick, peerdb-flow, sftpgo, chainloop-control-plane, kuma, argo-workflows-fips, gitlab-cng, kube-bench-fips, harbor-fips, pgtimetable-fips, rke2-cloud-provider, opentelemetry-collector-contrib, src, gitaly-fips, kine, spqr, kots, sftpgo-plugin-eventstore,...

CVE-2025-22874 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, blobfuse2, ghaudit, nri-f5, postgres-operator, terraform-provider-azapi, rabbitmq-default-user-credential-updater, govulncheck, hello-world-golang, telegraf, kyverno-policy-reporter-kyverno-plugin, grpcurl, yq, velero, dockerize, rootlesskit, sr...

GHSA-62JJ-GR2R-5C34 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, blobfuse2, ghaudit, nri-f5, postgres-operator, terraform-provider-azapi, rabbitmq-default-user-credential-updater, govulncheck, hello-world-golang, telegraf, kyverno-policy-reporter-kyverno-plugin, grpcurl, velero, dockerize, rootlesskit, src,...

GHSA-6F52-WPX2-HVF2 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, blobfuse2, ghaudit, nri-f5, postgres-operator, terraform-provider-azapi, rabbitmq-default-user-credential-updater, govulncheck, hello-world-golang, telegraf, kyverno-policy-reporter-kyverno-plugin, grpcurl, yq, velero, dockerize, rootlesskit, sr...

CVE-2025-4673 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, blobfuse2, ghaudit, nri-f5, postgres-operator, terraform-provider-azapi, rabbitmq-default-user-credential-updater, govulncheck, hello-world-golang, telegraf, kyverno-policy-reporter-kyverno-plugin, grpcurl, velero, dockerize, rootlesskit, src,...

File Upload Vulnerability in the Command and Dispatch Management Platform of Fujian Qualicom Communication Co.

Fujian Qualicom Communication Co., Ltd. is a solution provider and service operator focusing on professional communication. A file upload vulnerability exists in the Command and Dispatch Management Platform of Fujian Qualicom Communication Co. Ltd. that can be exploited by an attacker to upload a...