24381 matches found
GO-2026-5410 vulnerabilities
Vulnerabilities for packages: argo-cd-fips, kubernetes-event-exporter-fips, argo-rollouts, kyverno-policy-reporter, argo-events-fips, argo-cd, peerdb-flow, bento-fips, bento, kubewatch, atlantis-fips, argo-events, ory-kratos, kyverno-policy-reporter-fips, goreleaser, ory-kratos-fips,...
GO-2026-5410 vulnerabilities
Vulnerabilities for packages: kubernetes-event-exporter, atlantis, kyverno-policy-reporter, kubewatch, bento, argo-events, argo-cd, goreleaser, argo-rollouts...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, dbmate, cluster-api, harbor-registry, k9s, helm-push, delve, terraform-docs, crossplane-provider-aws-kinesis, kubeflow-katib, newrelic-nri-kube-events, nri-prometheus, zarf, migrate, coredns, kubescape, omnibump, osv-scanner,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, nri-f5, cluster-api-gcp-controller, azure-service-operator, dbmate, harbor-registry, gatekeeper, cloud-provider-vsphere, terraform-docs, crossplane-provider-aws-kinesis, kubeflow-katib, ytt, gobuster, osv-scanner, external-dns,...
GO-2024-2947 vulnerabilities
Vulnerabilities for packages: flux-image-automation-controller, crossplane-provider-azure-sql, rook, tkn, zarf, sigstore-scaffolding, rekor, k3d, kubescape, flux-image-reflector-controller, pulumi-kubernetes-operator, ksops, crossplane-provider-azure, flux-helm-controller, sops,...
CVE-2026-73840
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...
CVE-2026-73428 Trix: Stored XSS via HTMLParser attribute injection on paste
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a with an empty data-trix-attachment="" value, causing...
CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...
CVE-2026-73840
OpenChoreo is affected by a vulnerability in the POST /api/v1alpha1/autobuild endpoint (internal/openchoreo-api/api/handlers/webhook_handler.go) where a webhook provider is chosen from caller-controlled X-Event-Key, Bitbucket requests may be accepted without HMAC-SHA256 in X-Hub-Signature or a co...
CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...
CVE-2026-73569 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
CVE-2026-28174
Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...
CVE-2026-28173
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-28174
Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...
EUVD-2026-57957
Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...
CVE-2026-28173 WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-28174
Technical details, affected components, exploit vectors, and remediation are not publicly provided in the supplied documents; monitor for updates.
CVE-2026-28173
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-28173
The CVE-2026-28173 entry concerns the WordPress WP Event Solution plugin, versioned ≤ 4.1.19, with a vulnerability described as Customer Arbitrary Content Deletion. Supported details indicate a high-severity issue (CVSS 3.1: 7.1) with network attack vector, low attack complexity, and low privileg...