61724 matches found
CVE-2026-42875: Improper Authorization
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.0, Namespaced SecretStore resources that used CAProvider with type ConfigMap could resolve CA material from another namespace when caProvider.namespace w...
CVE-2026-42876: Improper Authorization
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...
PT-2026-39690
OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MCP server configuration, SSRF policy, a...
OpenClaw 安全漏洞
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.20 contained security vulnerabilities. These vulnerabilities stemmed from security bypasses in the proxy’s config.patch and config.apply endpoints, which failed to protect...
OpenClaw 安全漏洞
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.23 contained security vulnerabilities. These vulnerabilities stemmed from improper access control in the gateway tools config.apply and config.patch, allowing compromised models...
CVE-2026-7270
An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve2 argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges...
CVE-2026-6860 vulnerabilities
Vulnerabilities for packages: keycloak, wildfly, druid, knative-kafka-broker-fips, akhq, strimzi-kafka-operator, keycloak-fips, spark-kubernetes-operator, apache-pulsar, request-9047-keycloak-fips, strimzi-kafka-operator-fips, apicurio-registry-fips, hono, spark-kubernetes-operator-fips,...
GHSA-3G76-F9XQ-8VP6 vulnerabilities
Vulnerabilities for packages: keycloak, wildfly, druid, knative-kafka-broker-fips, akhq, strimzi-kafka-operator, keycloak-fips, spark-kubernetes-operator, apache-pulsar, request-9047-keycloak-fips, strimzi-kafka-operator-fips, apicurio-registry-fips, hono, spark-kubernetes-operator-fips,...
GHSA-PMWQ-PJRM-6P5R vulnerabilities
Vulnerabilities for packages: ko, buildkitd, vexctl, neuvector-sigstore-interface, docker-compose, docker, zot, skaffold, crossplane, gh, dagger, tkn, falcoctl, zarf, kyverno, cosign, tflint, trivy, bom, kubescape, spire-server, gitlab-runner, trivy-operator, flux-source-controller, guac,...
GHSA-C4RQ-3M3G-8WGX vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby3.3-rails, ruby3.2-rails, kube-logging-operator, ruby4.0-rails...
CVE-2025-15633
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data site names, versions, and configuration variables and bypass privilege requirements via unprotected endpoints lacking adequate security headers...
CVE-2025-15633 HCL BigFix WebUI is affected by an improper authorization vulnerability
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data site names, versions, and configuration variables and bypass privilege requirements via unprotected endpoints lacking adequate security headers...
CVE-2025-15633
The CVE describes an improper authorization flaw in HCL BigFix WebUI. An authenticated user lacking Master Operator privileges can access internal data (site names, versions, configuration variables) via unprotected endpoints that do not enforce security headers. This indicates a privilege check ...
CVE-2025-15633 HCL BigFix WebUI is affected by an improper authorization vulnerability
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data site names, versions, and configuration variables and bypass privilege requirements via unprotected endpoints lacking adequate security headers...
Exploit for Operator Precedence Logic Error in Freebsd
CVE-2026-7270 FreeBSD local privilege escalation via exec...
PT-2026-39320
Name of the Vulnerable Software and Affected Versions HCL BigFix WebUI affected versions not specified Description An improper authorization issue in HCL BigFix WebUI allows an authenticated user who lacks Master Operator privileges to bypass privilege requirements. This is possible due to...
in-toto-golang and in-toto-python have inconsistent negation behavior
Impact What kind of vulnerability is it? Who is impacted? in-toto-golang and in-toto-python both support glob patterns in artifact rules to indicate the artifacts that a rule applies to. Both support negations in character classes to indicate what should not be matched, but they used different...
gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense
Unauthenticated HTTP Transport Allows Unlimited Google Maps API Calls at Operator Expense The gmaps-mcp codebase was reviewed at commit e671db68c804c9e67d51582d3280839ffa65f127 and three issues worth flagging were discovered — one high-severity, one medium, one structural. There were no...