CVE-2026-113466

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

EUVD-2026-105033

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

CVE-2026-113466

A security vulnerability exists in MinIO (up to RELEASE.2025-10-15T17-29-55Z) within the Embedded Console component. The flaw is located in the globalDeploymentID/SessionTokenAuthenticate function of the cmd/common-main.go file, which leads to the use of a hard-coded cryptographic key . This vuln...

CVE-2026-113496

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

CVE-2026-105311

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105312

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on a...

Glassfish-research

GlassFish Security Research Vulnerability research on the Eclipse GlassFish administration console. CVE| Issue| Severity| Status ---|---|---|--- CVE-2026-2586| EL injection → RCE| 9.1 Critical| Fixed in 8.0.2 —| —| —| Pending disclosure CVE-2026-2586 — EL Injection to RCE Affected: 8.0.2 · CWE-91...

CVE-2026-105312

A vulnerability in the Console-operator for Apache Kafka Console allows a Kubernetes tenant with create permissions on Console custom resources to perform namespace-to-cluster privilege escalation . By setting spec.containers.api.spec.image to an arbitrary container image, an attacker can force t...

CVE-2026-105312 Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on a...

CVE-2026-105311

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105311

The StreamsHub Console operator is vulnerable to a confused deputy attack due to a lack of same-namespace checks. A Kubernetes tenant with permission to create a Console custom resource can specify an arbitrary namespace in spec.kafkaClusters[].credentials.kafkaUser.namespace. Because the operato...

EUVD-2026-104963

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105312

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on a...

EUVD-2026-104960

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

CVE-2026-113496 Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

CVE-2026-113496

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

hayduk

Hayduk: Open-source Metasploit GUI and Armitage alternative Hayduk is a free, open-source Metasploit GUI for authorized penetration testing. It brings the Armitage workflow to your browser: map hosts, browse modules, manage Meterpreter and shell sessions, and export campaign reports. Download one...