233 matches found
CVE-2025-4578
CVE-2025-4578 File Provider = 1.2.3 - 未認証SQLインジェクション 説明 WordPress用File Providerプラグインは、ユーザー指定パラメータのエスケープ処理が不十分で、既存のSQLクエリの準備も不十分なため、'fileId'パラメータを介したSQLインジェクションに対して、1.2.3を含む全バージョンで脆弱です。これにより、未認証の攻撃者が既存のクエリに追加のSQLクエリを注入し、データベースから機密情報を抽出することが可能になります。 詳細 タイプ : プラグイン Slug : file-provider 影響を受けるバージョン :...
EUVD-2026-47646
Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass...
Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass
Summary There is a medium-severity cross-provider reference vulnerability in Traefik's Kubernetes CRD provider. The crossProviderNamespaces allowlist is enforced for HTTP serversTransport references but was not enforced for IngressRouteTCP service serversTransport references. A low-privileged...
CVE-2026-65602
A flaw was found in Traefik. A low-privileged Kubernetes user can bypass the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references. By setting a forbidden cross-provider reference, Traefik may use a file-provider TCPServersTransport. This can lead to the exposu...
Duplicate Advisory: Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42cj-m3vj-89wv. This link is maintained to preserve external references. Original Description Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for...
GHSA-7M3P-WC52-RMC6 Duplicate Advisory: Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42cj-m3vj-89wv. This link is maintained to preserve external references. Original Description Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for...
CVE-2026-65602
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...
CVE-2026-65602 Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...
CVE-2026-65602
Traefik (3.6.0–3.6.22 and 3.7.0–3.7.6) fails to enforce crossProviderNamespaces allowlist for IngressRouteTCP serversTransport, permitting a low-privilege namespace user to set serversTransport: foo@file on an IngressRouteTCP service. This can cause Traefik to accept a cross-provider reference an...
CVE-2026-65602
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...
CVE-2026-65602 Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...
CVE-2026-65602
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...
PT-2026-63360
Name of the Vulnerable Software and Affected Versions Traefik versions 3.6.0 through 3.6.22 Traefik versions 3.7.0 through 3.7.6 Description Traefik fails to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references, as the allowlist was only applied to...
RHCOS 3 : OpenShift Container Platform 3.11.462 (RHSA-2021:2517)
The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2517 advisory. - jetty: local temporary directory hijacking vulnerability CVE-2020-27216 - jetty: buffer not correctly recycled in Gzip Request...
RHCOS 4 : OpenShift Container Platform 4.5.41 (RHSA-2021:2431)
The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2431 advisory. - jetty: local temporary directory hijacking vulnerability CVE-2020-27216 - jetty: buffer not correctly recycled in Gzip Request...
EUVD-2023-30358
Malicious code in bioql PyPI...
EUVD-2025-16842
Malicious code in bioql PyPI...
EUVD-2022-3337
Malicious code in bioql PyPI...