240 matches found
CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...
EUVD-2026-70212
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...
CVE-2026-45730
Nuclio is a serverless framework for real-time events and data processing. The vulnerability exists in the Nuclio Dashboard's project management API on write paths (PUT /api/projects/{id}, DELETE /api/projects). The root cause is that these endpoints construct PermissionOptions without setting Me...
CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...
CVE-2026-45730: Missing Authorization
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...
AZL-99315 CVE-2026-84304 affecting package opa 0.63.0-5
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
CLEANSTART-2026-XH81643 Security fixes in opa-fips 1.19.1-r2
Package opa-fips version 1.19.1-r2 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...
CLEANSTART-2026-NW77012 Security fixes in opa-fips 1.19.1-r1
Package opa-fips version 1.19.1-r1 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...
CLEANSTART-2026-SP20560 Security fixes in opa 1.19.1-r1
Package opa version 1.19.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...
AZL-98391 CVE-2026-37236 affecting package opa 0.63.0-5
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
gatekeeper v3.23.1
Gatekeeper How is Gatekeeper different from OPA? Compared to using OPA with its sidecar kube-mgmt aka Gatekeeper v1.0, Gatekeeper introduces the following functionality: An extensible, parameterized policy library Native Kubernetes CRDs for instantiating the policy library aka "constraints" Nativ...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099742)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099742 advisory. In the Linux kernel, the following vulnerability has been resolved: Revert IB/isert: Fix incorrect release of isert connection Commit: 699826f4e30a IB/isert: Fix...
GO-2022-0574 vulnerabilities
Vulnerabilities for packages: opa...
GO-2022-0587 vulnerabilities
Vulnerabilities for packages: opa...
GO-2026-4506 vulnerabilities
Vulnerabilities for packages: opa-envoy, opa-fips-envoy...
GO-2024-3141 vulnerabilities
Vulnerabilities for packages: spire-server, spire-server-fips, opa, conftest, k8sgpt, kubescape, policy-controller-fips, tfsec, zarf, zot, cosign-fips, conftest-fips, policy-controller, kots, snyk-cli, cosign...
GO-2025-4100 vulnerabilities
Vulnerabilities for packages: nerdctl, opa-envoy, cloudbeat, gitlab-rails-ce-fips, kubescape, gitlab-rails-ce, kubevela, docker-compose, kubevela-fips, consul-k8s, grype, k8ssandra-client-fips, helm-diff, trivy-operator-fips, cert-manager-cmctl, apm-server-fips, helm, rancher-agent,...
GO-2025-3372 vulnerabilities
Vulnerabilities for packages: opa-envoy, smarter-device-manager, pulumi-kubernetes-operator, kube-bench-fips, crossplane-provider-gcp, amass, step-ca-fips, caddy, google-osconfig-agent, kyverno, cluster-proportional-autoscaler, portieris-fips, spark-operator, portieris, step-ca, opa-fips-envoy,...
GO-2025-4175 vulnerabilities
Vulnerabilities for packages: k6-operator-fips, net-kourier-fips, cert-manager-csi-driver-fips, ratify-fips, portieris-fips, kubernetes-csi-driver-nfs-fips, contour-fips, kubernetes-csi-external-resizer-fips, kube-logging-operator-custom-runner-fips, temporal, dataplaneapi-fips,...
