Red Hat Security AdvisoryRHSA-2026:67540
Red Hat Advanced Cluster Management for Kubernetes v2.13.12 security update
Released 2026-09-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
Fixes 10 records
Priority HIGH 72
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0053 · Published 2026-08-17 · Partial fix · 8.5.18 CWE-22
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00336 · Published 2026-06-04 · Partial fix · 1.42.0, 1.44.0 CWE-789
Priority MEDIUM 46
Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0103 · Published 2026-07-27 · Partial fix · 0.24.0 CWE-190
Priority MEDIUM 46
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0103 · Published 2026-07-27 · Partial fix · 0.24.0 CWE-409
Priority MEDIUM 40
Helm is a package manager for Charts for Kubernetes.
CVSS 3.1HIGH 8.6· Local · No auth · User interaction · EPSS 0.00494 · Published 2025-07-08 · Partial fix · 3.18.4, 3.17.4 CWE-94
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00475 · Published 2026-07-21 · Partial fix · 0.39.0 CWE-835
Priority LOW 39
Prometheus is an open-source monitoring system and time series database.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00352 · Published 2026-05-04 · Partial fix · 3.5.3, 3.11.3 +1 CWE-200
Priority LOW 34
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryColl…
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00475 · Published 2026-09-11 · Fixed in 1789126264, 1789126262 +1 CWE-551
Priority LOW 32
A flaw was found in the submariner-operator component.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00579 · Published 2026-08-18 · Partial fix · 1789135606, 1789131397 +9 CWE-532
Priority LOW 31
go-git is an extensible git implementation library written in pure Go.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00357 · Published 2026-08-07 · Partial fix · 5.19.2, 6.0.0-alpha.5 CWE-59
THREATIST.IORead the docs