GHSA-QF5V-M7P4-95RP Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer, but the capability check was implemented as a fixed denylist of six Linux...

PT-2026-60688

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description An issue exists in the Wasm HTTP fetch mechanism where the getFileFromGZ function calls io.ReadAll on a raw gzip.Reader without an output bound. While the compressed input is capped at...

PT-2026-45493

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 0.20.0 through 2.0.11 Description Authenticated agents can forge service-monitor results for services belonging to other users. The system accepts TaskResult messages from an authenticated agent based solely on whethe...