59633 matches found
MinIO Operator Console Authentication Bypass
MinIO Console is a graphical user interface for the for MinIO Operator. MinIO itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. id: CVE-2021-41266 info: name: MinIO Operator...
Windmill < 1.603.3 - SQL Injection
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...
Windmill < 1.603.3 - Operator Authorization Bypass
Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are...
GHSA-C974-W86C-VPFW vulnerabilities
Vulnerabilities for packages: ferretdb, cert-manager-webhook-pdns, task, crossplane-provider-azure-authorization, tekton-chains, terraform-docs, terraform-provider-kubernetes, cloud-provider-vsphere, grafana-rollout-operator, kubescape, crossplane-provider-aws-cloudfront, cert-manager,...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: cloud-provider-vsphere, grafana-rollout-operator, kubescape, xeol, tetragon, pvc-autoresizer, kube-vip, k6, sbomqs, thanos-operator, kserve-rest-proxy, octo-sts, nginx-prometheus-exporter, ip-masq-agent, git-lfs, cloudnative-pg, sftpgo, delve, descheduler, dive,...
CVE-2026-56862 vulnerabilities
Vulnerabilities for packages: cloud-provider-vsphere, grafana-rollout-operator, kubescape, xeol, tetragon, pvc-autoresizer, kube-vip, k6, sbomqs, thanos-operator, kserve-rest-proxy, octo-sts, nginx-prometheus-exporter, ip-masq-agent, git-lfs, cloudnative-pg, sftpgo, delve, descheduler, dive,...
EUVD-2026-58805
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...
EUVD-2026-58804
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...
CVE-2025-7639
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...
CVE-2025-7639
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...
CVE-2026-57469
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...
CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...
GO-2025-4161 vulnerabilities
Vulnerabilities for packages: victorialogs, victoriametrics-operator-fips, victorialogs-fips...
GO-2026-5298 vulnerabilities
Vulnerabilities for packages: teleport, teleport-operator-fips, tbot...
GO-2025-3504 vulnerabilities
Vulnerabilities for packages: tigera-operator-fips, tigera-operator...
GO-2021-0066 vulnerabilities
Vulnerabilities for packages: spark-operator...
GO-2025-3690 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator-fips, seaweedfs-operator...
GO-2024-3239 vulnerabilities
Vulnerabilities for packages: nvidia-gpu-operator-validator, nvidia-container-toolkit...