CVE-2026-76316

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:50+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmwink3bv24...

CVE-2026-76315

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:48+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmuszamoh23...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis, crossplane-provider-aws-cloudfront, crossplane-provider-azure-sql, crossplane-provider-azure-managedidentity, terraform-provider-grafana, crossplane-provider-aws-firehose, crossplane-provider-azure-storage, nuclei,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, cluster-api-helm-controller, cilium, kube-state-metrics, kubernetes-csi-external-provisioner, kube-metrics-adapter, helm-operator, azure-service-operator, cluster-api-ipam-provider-in-cluster, metrics-server, rancher-system-agent,...

CVE-2026-73500 affecting package cloud-provider-kubevirt for versions less than 0.5.1-7

CVE-2026-73500 affecting package cloud-provider-kubevirt for versions less than 0.5.1-7. A patched version of the package is available...

CVE-2026-73500 affecting package kube-vip-cloud-provider for versions less than 0.0.10-8

CVE-2026-73500 affecting package kube-vip-cloud-provider for versions less than 0.0.10-8. A patched version of the package is available...

EUVD-2026-63103

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...

PT-2026-79262

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-47827 - BOSH CLI Powershell Injection | Cloud Foundry

HIGH CVSSv4: High 7.7 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSSv3: High 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is HIGH unless otherwise noted. BOSH CLI tool – All versions v2.840.0 Description Command...

CVE-2026-76251

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...

EUVD-2026-62855

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

CVE-2026-53549 Termix: Server-Side Request Forgery via Proxy Connectivity Test

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The weburlread tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when...

GHSA-Q87F-QC2R-2GW4 SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The weburlread tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when...

Security Bulletin: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

Summary The github.com/hashicorp/go-slug library before v0.18.3 is vulnerable to an exclusion bypass in .terraformignore handling that may allow files intended to be excluded from Terraform Cloud or Terraform Enterprise working directory uploads to be included instead on affected macOS filesystem...

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to...

CVE-2026-45741

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::/10 deprecated site-local prefix, Teredo, and other...

CVE-2026-45741 Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::/10 deprecated site-local prefix, Teredo, and other...

CVE-2026-45741 Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::/10 deprecated site-local prefix, Teredo, and other...

EUVD-2026-62422

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::/10 deprecated site-local prefix, Teredo, and other...