PT-2026-88964

A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...

EUVD-2026-67209

mongodb: Reject "." and NUL bytes in database and collection names...

SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

EUVD-2026-69653

SVGO: removeScripts allows executable links through namespace and control-character bypasses...

NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses

NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...

GHSA-W27V-7Q3P-W38R SVGO: removeScripts allows executable links through namespace and control-character bypasses

Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...

xmldom: Quadratic-memory consumption

Summary When an element declares a namespace prefix, xmldom copies the entire in-scope namespace map into a fresh object and keeps that copy on the element while it is open on the parse stack. A crafted document that nests N elements, each declaring one unique prefix, therefore drives the parser ...

EUVD-2026-69236

xmldom: Quadratic-memory consumption...

GHSA-965W-775F-MR7G xmldom: Quadratic-memory consumption

Summary When an element declares a namespace prefix, xmldom copies the entire in-scope namespace map into a fresh object and keeps that copy on the element while it is open on the parse stack. A crafted document that nests N elements, each declaring one unique prefix, therefore drives the parser ...

EUVD-2026-65440

NLTK: Allowlisted pickle loaders still permit code execution in current source...

NLTK: Allowlisted pickle loaders still permit code execution in current source

Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...

CVE-2026-78234 Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name CN supplied by the author of a namespaced Hawtio custom resource. Because the operator...

CVE-2026-78234

hawtio-operator in OpenShift contains a Service CA signing oracle flaw. The operator reads the Service CA private signing key from the openshift-service-ca namespace and mints client certificates whose Subject CN is taken directly from the author of a namespaced Hawtio custom resource. Because th...

kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls

A flaw was found in the Linux kernel's Point-to-Point Protocol PPP subsystem. A local unprivileged user can exploit this vulnerability by creating a new user namespace and bypassing authorization checks for unattached administrative input/output controls ioctls. This allows the user to perform...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053400)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053400 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespace. Recently, we got a customer report that CI...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053295)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053295 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: serialize hash resizes and cleanups Syzbot was able to trigger the followin...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053326 advisory. In the Linux kernel, the following vulnerability has been resolved: cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns What we want is to...

SUSE CVE-2026-54523

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...

SUSE CVE-2026-65601

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

SUSE CVE-2026-65602

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...