286 matches found
CVE-2026-62440
An Improper Access Control vulnerability exists in the Kubernetes Service (CKS) plugin of Apache CloudStack , affecting versions 4.21.0.0 through 4.22.1.0 . This flaw allows for cross-tenant manipulation of the Kubernetes cluster specifically during the processes of adding and removing nodes . To...
CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...
CVE-2026-62440
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...
CVE-2026-62440: Improper Access Control
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...
CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
CVE-2026-50516
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-50516 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
...
CVE-2026-50516 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
...
CVE-2026-50516
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-56778
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
PT-2026-70387
Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...
CVE-2026-50516: Missing Authentication for Critical Function
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
Malicious code in merge-grid-stats (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1 Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook node install-cb.js executes on npm install...
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network...
MAL-2026-11558 Malicious code in @cacheable/memory (npm)
npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...
Exploit for CVE-2026-21008
--- CVE-2026-21008 – Kubernetes Service Account Token Mounte...
EUVD-2026-51093
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
CVE-2026-56163
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-56163
The vulnerability CVE-2026-56163 affects Microsoft Azure Kubernetes Service. It arises from missing authentication for a critical function, enabling an unauthenticated attacker to achieve network-based elevation of privilege within the service. The reported impact is high for confidentiality, int...