8764 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-34179
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH...
[SECURITY] Fedora 42 Update: corosync-3.1.9-4.fc42
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
CVE-2026-35206 vulnerabilities
Vulnerabilities for packages: cert-manager-cmctl, chart-testing, headlamp, zot, cilium-cli, kots, consul-k8s, kuma, chartmuseum, rancher-fleet, kube-arangodb, kubescape, harbor, eksctl, cerbos, tigera-operator, tw, k9s, envoy-gateway, helm-set-status, helm-push, trivy, istio, helm-mapkubeapis,...
GHSA-HR2V-4R36-88HR vulnerabilities
Vulnerabilities for packages: cert-manager-cmctl, chart-testing, headlamp, zot, cilium-cli, kots, consul-k8s, kuma, chartmuseum, rancher-fleet, kube-arangodb, kubescape, harbor, eksctl, cerbos, tigera-operator, tw, k9s, envoy-gateway, helm-set-status, helm-push, trivy, istio, helm-mapkubeapis,...
GHSA-HR2V-4R36-88HR vulnerabilities
Vulnerabilities for packages: chart-testing-fips, helm-push, k8ssandra-client, linkerd2-fips, tigera-operator, zarf, flux, flux-fips, helm-exporter-fips, chartmuseum-fips, envoy-gateway, consul-k8s, flux-source-controller-fips, harbor-fips, helm-set-status, jfrog-cli, cerbos-fips, cilium-cli,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: argo-rollouts, prometheus, opentelemetry-collector, spqr, crossplane-provider-keycloak, libnvidia-container, victoriametrics-operator, kube-arangodb, crossplane-provider-sql, stern, kubernetes-csi-external-health-monitor, dex, gitsign, kbld,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: argo-rollouts, prometheus, spqr, crossplane-provider-keycloak, libnvidia-container, victoriametrics-operator, kube-arangodb, crossplane-provider-sql, stern, kubernetes-csi-external-health-monitor, dex, gitsign, kbld, docker-credential-ecr-login, pulumi,...
GHSA-JRG3-GFJW-HM96 vulnerabilities
Vulnerabilities for packages: argo-rollouts, prometheus, spqr, crossplane-provider-keycloak, libnvidia-container, victoriametrics-operator, kube-arangodb, crossplane-provider-sql, stern, kubernetes-csi-external-health-monitor, dex, gitsign, kbld, docker-credential-ecr-login, pulumi,...
CVE-2026-35206 vulnerabilities
Vulnerabilities for packages: chart-testing-fips, helm-push, k8ssandra-client, linkerd2-fips, tigera-operator, zarf, flux, flux-fips, helm-exporter-fips, chartmuseum-fips, envoy-gateway, consul-k8s, flux-source-controller-fips, harbor-fips, helm-set-status, jfrog-cli, cerbos-fips, cilium-cli,...
CVE-2026-32288 vulnerabilities
Vulnerabilities for packages: act, flux, helm-exporter-fips, flux-source-controller-fips, mattermost-fips, cloud-provider-aws, hubble, docker-cli-fips, datadog-agent, step-ca-fips, azuredisk-csi-fips, docker-cli-buildx, gosu, calico, licenseclassifier, tekton-pipelines, openbao, falcoctl,...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: act, flux, helm-exporter-fips, flux-source-controller-fips, mattermost-fips, cloud-provider-aws, hubble, docker-cli-fips, datadog-agent, step-ca-fips, azuredisk-csi-fips, docker-cli-buildx, gosu, calico, licenseclassifier, tekton-pipelines, openbao, falcoctl,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: act, flux, helm-exporter-fips, kafka-proxy, crossplane-provider-azure-authorization, kubernetes-csi-external-resizer, nri-redis-fips, terraform-ls, flux-source-controller-fips, nginx-kubernetes-ingress-fips, k3d, nri-postgresql, tailscale, mattermost-fips,...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: kubecolor, lazygit, datadog-agent, azuredisk-csi-fips, gosu, calico, dapr, crossplane-provider-aws-wafv2, hello-world-golang, nri-couchbase-fips, trivy-operator, kube-mgmt-fips, trivy, localstack, azure-container-networking, k8s-device-plugin, authservice-fips,...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the AdminService/StreamWorkflowReplicationMessages endpoint. An attacker can access replication streams and exfiltrate data by connecting to the frontend gRPC server without providing...
EUVD-2026-21607
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests...
CVE-2026-5724
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests...
EUVD-2026-20876
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin...
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
Summary A restricted TLS certificate user can escalate to cluster admin by changing their certificate type from client to server via PUT/PATCH to /1.0/certificates/fingerprint. The non-admin guard and reset block in doCertificateUpdate fail to validate or reset the Type field, allowing a...
GHSA-C3H3-89QF-JQM5 LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
Summary A restricted TLS certificate user can escalate to cluster admin by changing their certificate type from client to server via PUT/PATCH to /1.0/certificates/fingerprint. The non-admin guard and reset block in doCertificateUpdate fail to validate or reset the Type field, allowing a...