github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

CVE-2026-84196

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

EUVD-2026-69033

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196

Kyverno before 1.18.0 is affected by a server-side request forgery (SSRF) in the apiCall.service.url field. The root cause is variable substitution that allows authenticated users to inject user-controlled input, enabling arbitrary outbound HTTP requests to internal services, cloud metadata endpo...

CVE-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84196: Server-Side Request Forgery (SSRF)

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84639: Use of Uninitialized Variable

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

EUVD-2026-68886

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...

Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

MGASA-2026-0349 Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

MAL-2026-15633 Malicious code in spc-grafeno-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2 The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, ...

SUSE CVE-2026-72150

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix uninitialized xprtcreateargs structure The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. While some fields are manually populated, critical fields like...

CVE-2026-80711

A flaw was found in the Linux kernel's power supply subsystem, specifically within the MAX17040 fuel gauge driver. When the MAX17040 fuel gauge operates without a registered charger status supplier, the driver fails to properly handle this missing information. This oversight can result in userspa...

PT-2026-89705

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively...

Linux Distros Unpatched Vulnerability : CVE-2026-80648

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...