CVE-2026-53472 Migration-planner: credentialurl validator accepts javascript: urls

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

GO-2026-4513 vulnerabilities

Vulnerabilities for packages: flyte...

GO-2026-5336 vulnerabilities

Vulnerabilities for packages: syft-fips, xeol-fips, nemo, trivy-operator, skaffold-fips, xeol, rancher-fleet-fips, mapotf, grype, packer-fips, argo-events-fips, flux-image-automation-controller, external-secrets-operator, gomplate, kubevela-fips, grafana-alloy-fips, trivy-fips, gitlab-rails-ce,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: syft-fips, nemo, trivy-operator, skaffold-fips, kine, minio, flux-source-controller, external-dns, mapotf, grype, splunk-otel-collector-fips, knative-kafka-broker, packer-fips, argo-events-fips, cloud-provider-aws, flux-image-automation-controller,...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50236 Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50236 Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

EUVD-2026-56133

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50236

The CVE-2026-50236 issue affects OpenShift OpenShift Console Dev Console webhook helpers, where authenticated users can trigger SSRF by supplying target URLs that are fetched server-side without validation. The underlying flaw enables path neutralization that can target arbitrary endpoints and re...

CVE-2026-50237

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

EUVD-2026-56132

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-50237

Summary: CVE-2026-50237 affects the OpenShift Console Helm catalog proxy. A namespace tenant can create a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress controls. This, combined with catalog metadata poisoning and admin‑mediated ...

CVE-2026-50237 Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-50237 Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50237

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

EUVD-2025-210672

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

PT-2026-70151

Name of the Vulnerable Software and Affected Versions OpenShift Console affected versions not specified Description An authenticated Server-Side Request Forgery SSRF flaw exists in the OpenShift Console Dev Console webhook helpers. The system fetches user-supplied target URLs server-side without...

PT-2026-70152

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...