TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
RHSA-2026:67541
Red Hat Advanced Cluster Management for Kubernetes v2.15.7 security update
Released 2026-09-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +9
Fixes 10 records
TI-2026-40371 CVE-2026-55969 · GHSA-x8jh-qfcv-fp29
Integer overflow in Apache Thrift
Priority MEDIUM 46
Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.
TI-2026-35942 CVE-2026-48586 · GHSA-6h9h-5c4r-fqgf
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift…
Priority MEDIUM 46
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.
TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
Priority MEDIUM 40
Prometheus is an open-source monitoring system and time series database.
TI-2025-33491 CVE-2025-53547 · GHSA-557j-xg8c-q2mm
Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
Priority MEDIUM 40
Helm is a package manager for Charts for Kubernetes.
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r
Infinite loop on invalid input in golang.org/x/text
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
TI-2026-60358 CVE-2026-89060 · GHSA-39w5-9x42-rwmr
Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in…
Priority LOW 34
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryColl…
TI-2026-47425 CVE-2026-66780 · GHSA-3xmh-phwc-5f4g
Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
Priority LOW 32
A flaw was found in the submariner-operator component.
TI-2026-50128 CVE-2026-71556 · GHSA-hc8v-wwc9-vgxm
go-git: Worktree operations may follow symlinks
Priority LOW 31
go-git is an extensible git implementation library written in pure Go.
TI-2026-30785 CVE-2026-42502 · GHSA-wrh2-89vg-4j9g
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.