CLEANSTART-2026-AI26012 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the kube-state-metrics-fips package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...

CLEANSTART-2026-TX77163 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the kube-state-metrics-fips package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-NP15118 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the kube-state-metrics-fips package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...

CLEANSTART-2026-DO16074 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the kube-state-metrics-fips package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-QL41079 Arithmetic over induction variables in loops were not correctly checked for underflow or overflow

Security vulnerability affects the kube-state-metrics-fips package. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow...

CLEANSTART-2026-OK73778 SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass

Security vulnerability affects the kube-state-metrics-fips package. SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CLEANSTART-2026-KJ60632 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the kube-state-metrics-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

CLEANSTART-2026-SF83107 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the kube-state-metrics-fips package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-WT03886 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the kube-state-metrics-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-ON08381 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the kube-state-metrics-fips package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-ID25713 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the kube-state-metrics-fips package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-HO44930 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the kube-state-metrics-fips package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-BS59545 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the kube-state-metrics-fips package. Previously, resolving relative paths containing parent directory '...

bug-bounty-reports-desai-vinayak

🧩 Bug Bounty Reports — Desai Vinayak 🔒 Bug bounty and vulnerability research reports by Desai Vinayak. This repository collects passive, non-destructive vulnerability write-ups and supporting evidence for coordinated disclosure and remediation tracking. 📁 Contents 📂 reports/ — PDF, DOCX, and...

Linux Distros Unpatched Vulnerability : CVE-2026-101333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the...

CVE-2026-95308

A flaw was found in chromium-browser. An integer overflow in the Metrics component allows a remote attacker who has already compromised the renderer process to read memory outside the security sandbox. By convincing a user to visit a crafted HTML page, the attacker can exploit this issue to acces...

CVE-2026-95333

An use after free flaw was found in the Metrics component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=559682346...

DEBIAN-CVE-2026-95333

Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-95333

Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

DEBIAN-CVE-2026-95308

Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. Chromium security severity: Low...