GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: prometheus-operator, zarf, istio, pulumi-kubernetes-operator, telegraf, kubernetes-dashboard, k3s, aactl, chezmoi, cilium-cli, snyk-cli, flux-source-controller, kubescape, pulumi, trivy, grype, step, flux-image-automation-controller, opentofu, cilium, cert-manager,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: rancher, prometheus-operator, containerd, cilium, flux, kots, kubernetes, kyverno, nerdctl, istio, cert-manager, mattermost, external-dns, telegraf, buildah, prometheus, zot, minio, cloud-provider-aws, kubernetes-dashboard, k3s, aactl, kaf, docker-cli-buildx, kine,...

CVE-2026-13281

creationtimestamp| type| source ---|---|--- 2026-06-26 09:45:05+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1937 2026-06-26 14:40:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mp76fcsqgb2j 2026-06-28 22:30:18+00:00| seen|...

CVE-2026-55964

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs WOLFSSLTEMPCA added while building a certificate path were previously exempt...

DEBIAN-CVE-2026-11310

X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier wolfSSLX509verifycert. This affects only builds with --enable-opensslextra OPENSSLEXTRA and whose application validates certificates by calling X509verifycert with caller-supplied untrusted intermediate certificates; for...

CVE-2026-13034

creationtimestamp| type| source ---|---|--- 2026-06-25 05:46:08+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260625 2026-06-25 12:00:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mp4ey2p4eu2c 2026-07-01 02:46:23+00:00| seen|...

CVE-2026-13033

creationtimestamp| type| source ---|---|--- 2026-06-25 05:46:06+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260625 2026-06-25 12:00:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mp4ey2p4eu2c 2026-06-30 22:37:06+00:00| seen|...

CVE-2026-5952

creationtimestamp| type| source ---|---|--- 2026-06-25 05:45:20+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260625 2026-06-25 06:11:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3rhugxdv2z 2026-06-25 12:00:27+00:00| seen|...

CVE-2026-5309

creationtimestamp| type| source ---|---|--- 2026-06-25 05:45:15+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260625 2026-06-25 06:30:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3sky7vtu2t 2026-06-25 12:00:27+00:00| seen|...

CVE-2026-2238

creationtimestamp| type| source ---|---|--- 2026-06-25 05:45:10+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260625 2026-06-25 06:50:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3toslmhm2b 2026-06-25 12:00:27+00:00| seen|...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: aws-fsx-csi-driver, kubernetes-csi-external-snapshotter, crossplane-provider-aws-osis-fips, kubevirt-cdi-uploadserver, beats-fips, dgraph, crossplane-function-patch-and-transform-fips, kgateway-fips, kubernetes-dns-node-cache-fips, external-secrets-operator,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: aws-fsx-csi-driver, kubernetes-csi-external-snapshotter, crossplane-provider-aws-osis-fips, kubevirt-cdi-uploadserver, beats-fips, dgraph, crossplane-function-patch-and-transform-fips, kgateway-fips, kubernetes-dns-node-cache-fips, external-secrets-operator,...

GHSA-7WWH-XCC3-9FCG Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module

Summary The PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations. Technical details: The /extensions/paypal/webhook endpoint processes incoming webhook requests and trus...

CVE-2026-12249

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services AD CS certificate auto-enrollment via the vendored Samba client script internal/policies/certificate/python/vendorsamba/gp/gpcertautoenrollext.py, ADSys utilizes a plaintext...

CERTFR-2026-ACT-027

creationtimestamp| type| source ---|---|--- 2026-06-22 13:28:44+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3mouyjlshrm2z 2026-06-22 13:29:08+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116793994374387639 2026-06-22 13:36:55+00:00| seen|...

CVE-2025-48571

creationtimestamp| type| source ---|---|--- 2026-06-21 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260622 2026-06-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1931...

CVE-2025-48617

creationtimestamp| type| source ---|---|--- 2026-06-21 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260622 2026-06-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1931 2026-08-28 18:00:05+00:00| seen|...

CVE-2026-54222

creationtimestamp| type| source ---|---|--- 2026-06-18 05:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-54219 2026-06-18 15:53:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mol6qkof7z2j...

CVE-2026-54221

creationtimestamp| type| source ---|---|--- 2026-06-18 05:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-54219 2026-06-18 15:58:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mol6zj5mne2o...

CVE-2026-40455

creationtimestamp| type| source ---|---|--- 2026-06-18 04:55:00+00:00| seen| https://cert.pl/en/posts/2026/06/CVE-2026-40455 2026-06-18 13:28:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mokwmyt6s62t...