agentprime: red-hat-advanced-cluster-management-for-kubernetes-2-11Every new CVE for red-hat-advanced-cluster-management-for-kubernetes-2-11.https://agentprime.io/CVE-2026-73137: Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespacehttps://agentprime.io/advisories/CVE-2026-73137/https://agentprime.io/advisories/CVE-2026-73137/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 20:34:13 GMTCVECVE-2026-67567: Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restrictionhttps://agentprime.io/advisories/CVE-2026-67567/https://agentprime.io/advisories/CVE-2026-67567/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 20:34:10 GMTCVEcriticalCVE-2026-76827: Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)https://agentprime.io/advisories/CVE-2026-76827/https://agentprime.io/advisories/CVE-2026-76827/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 20:56:17 GMTCVECVE-2026-76139: Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentialshttps://agentprime.io/advisories/CVE-2026-76139/https://agentprime.io/advisories/CVE-2026-76139/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 20:47:50 GMTCVECVE-2026-70496: Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestworkhttps://agentprime.io/advisories/CVE-2026-70496/https://agentprime.io/advisories/CVE-2026-70496/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 18:16:13 GMTCVEcriticalCVE-2026-18874: Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscriptionhttps://agentprime.io/advisories/CVE-2026-18874/https://agentprime.io/advisories/CVE-2026-18874/CVSS 6.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 17:52:39 GMTCVECVE-2026-71470: Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sahttps://agentprime.io/advisories/CVE-2026-71470/https://agentprime.io/advisories/CVE-2026-71470/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 17:11:02 GMTCVEcriticalCVE-2026-66780: Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosityhttps://agentprime.io/advisories/CVE-2026-66780/https://agentprime.io/advisories/CVE-2026-66780/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 17:32:00 GMTCVECVE-2026-66781: Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authenticationhttps://agentprime.io/advisories/CVE-2026-66781/https://agentprime.io/advisories/CVE-2026-66781/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 17:05:52 GMTCVECVE-2026-75485: Must-gather: /tmp/kubeconfig retentionhttps://agentprime.io/advisories/CVE-2026-75485/https://agentprime.io/advisories/CVE-2026-75485/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:15:42 GMTCVECVE-2026-73834: Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redactionhttps://agentprime.io/advisories/CVE-2026-73834/https://agentprime.io/advisories/CVE-2026-73834/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:15:38 GMTCVECVE-2026-66793: Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spokehttps://agentprime.io/advisories/CVE-2026-66793/https://agentprime.io/advisories/CVE-2026-66793/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:02:31 GMTCVECVE-2026-71472: Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_memhttps://agentprime.io/advisories/CVE-2026-71472/https://agentprime.io/advisories/CVE-2026-71472/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 19:28:43 GMTCVEcriticalCVE-2026-70495: Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:mastershttps://agentprime.io/advisories/CVE-2026-70495/https://agentprime.io/advisories/CVE-2026-70495/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 19:28:37 GMTCVECVE-2026-66792: Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustershttps://agentprime.io/advisories/CVE-2026-66792/https://agentprime.io/advisories/CVE-2026-66792/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 18:12:36 GMTCVEcriticalCVE-2026-71846: Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilegehttps://agentprime.io/advisories/CVE-2026-71846/https://agentprime.io/advisories/CVE-2026-71846/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 21:46:19 GMTCVECVE-2026-71469: Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion doshttps://agentprime.io/advisories/CVE-2026-71469/https://agentprime.io/advisories/CVE-2026-71469/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 21:40:13 GMTCVECVE-2026-71471: Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container imagehttps://agentprime.io/advisories/CVE-2026-71471/https://agentprime.io/advisories/CVE-2026-71471/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 21:40:11 GMTCVEcriticalCVE-2026-71473: Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spokehttps://agentprime.io/advisories/CVE-2026-71473/https://agentprime.io/advisories/CVE-2026-71473/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 21:40:09 GMTCVECVE-2026-72508: Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)https://agentprime.io/advisories/CVE-2026-72508/https://agentprime.io/advisories/CVE-2026-72508/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 19:41:18 GMTCVEcriticalCVE-2026-64927: Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputyhttps://agentprime.io/advisories/CVE-2026-64927/https://agentprime.io/advisories/CVE-2026-64927/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 01:12:08 GMTCVECVE-2026-73122: Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaceshttps://agentprime.io/advisories/CVE-2026-73122/https://agentprime.io/advisories/CVE-2026-73122/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 01:10:47 GMTCVECVE-2026-66878: Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltrationhttps://agentprime.io/advisories/CVE-2026-66878/https://agentprime.io/advisories/CVE-2026-66878/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 01:10:38 GMTCVECVE-2026-70398: Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespacehttps://agentprime.io/advisories/CVE-2026-70398/https://agentprime.io/advisories/CVE-2026-70398/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 01:10:32 GMTCVEcriticalCVE-2026-72526: Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotationhttps://agentprime.io/advisories/CVE-2026-72526/https://agentprime.io/advisories/CVE-2026-72526/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Aug 2026 01:10:28 GMTCVEcriticalCVE-2026-71474: Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx responsehttps://agentprime.io/advisories/CVE-2026-71474/https://agentprime.io/advisories/CVE-2026-71474/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 19:24:56 GMTCVECVE-2026-71468: Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cachehttps://agentprime.io/advisories/CVE-2026-71468/https://agentprime.io/advisories/CVE-2026-71468/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 19:24:21 GMTCVECVE-2026-71845: Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()https://agentprime.io/advisories/CVE-2026-71845/https://agentprime.io/advisories/CVE-2026-71845/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 19:22:12 GMTCVECVE-2026-10090: Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscriptionhttps://agentprime.io/advisories/CVE-2026-10090/https://agentprime.io/advisories/CVE-2026-10090/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 08:54:55 GMTCVEcritical