CVE-2026-66795 Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

CVE-2026-66795 Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

EUVD-2026-60452

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

CVE-2026-66795

The managedcluster-import-controller's CSR auto-approver skips validation of signer name, certificate subject, and requester identity, letting a privileged spoke-cluster service account submit a malicious CSR and escalate to hub-cluster admin. CVSS 9.1 critical; no exploitation evidence provided....

CVE-2026-66795

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

CVE-2026-63667

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667

ApostropheCMS versions before 3.6.2 are vulnerable to arbitrary file read via path traversal in the import-export module. The file packages/import-export/lib/formats/gzip.js builds an attachment source path using attacker-controlled _id, name, and extension fields from aposAttachments.json withou...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

Incomplete List of Disallowed Inputs

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Protection Mechanism Failure

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75058

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

EUVD-2026-60246

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75047

JetBrains YouTrack before version 2026.2.18177 is vulnerable to a denial-of-service attack via a decompression bomb submitted to the import endpoint. A low-privileged authenticated user can trigger high availability impact (CVSS 6.5) without user interaction. Exploitation details are not provided...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-16044

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...