CVE-2026-108690 mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList...

CVE-2026-108690

Versions of mall4j through 4.0 are vulnerable to an information disclosure flaw caused by an operator precedence error in the getShopCartExpiryItems SQL filter. An authenticated attacker with any storefront account can access the GET /p/shopCart/expiryProdList endpoint to view other users' shoppi...

CLEANSTART-2026-GI35870 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

CLEANSTART-2026-RX13164 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-IV56904 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-EN61439 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...

CLEANSTART-2026-FI20100 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

CVE-2026-108690: Operator Precedence Logic Error

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList...

CloudGarrison

CloudGarrison Multi-Cloud Posture Workbench CloudGarrison is an offline-capable operator console designed for local evidence analysis, multi-cloud posture planning, and isolated simulations across AWS, Azure/Entra ID, GCP, Kubernetes, identity graphs, and detection engineering platforms. This loc...

GHSA-22JX-P735-QCPM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, json-exporter-fips, prometheus-fips, kepler-fips, chainloop-control-plane-fips, kserve-modelmesh-serving, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront-fips, kubevirt-cdi-controller, perses,...

CVE-2026-56857 vulnerabilities

Vulnerabilities for packages: prometheus, containerd, cert-manager, commercial-chainloop-cli, google-osconfig-agent, karpenter-fips, reports-server, karpenter, falco-no-driver, external-dns, commercial-gitlab-workhorse-ee, frankenphp-8.4, consul-k8s-fips, commercial-grafana,...

GO-2026-6605 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator, verticadb-operator, kubernetes-dashboard-metrics-scraper, cluster-api-aws-controller, trivy, newrelic-nri-statsd, kubernetes-csi-external-snapshotter, kuberlr, nri-mssql, external-secrets-operator, github-mcp-server, gitness, gostatsd, harbor,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ds, ksops-fips, nri-consul, crossplane-provider-aws-gamelift, jobset-fips, crossplane-provider-family-aws-fips, kyverno-policy-reporter-plugins-trivy, monstache, crossplane-provider-family-gcp-config-fips, gke-deploy, keda-http-add-on,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ds, chainloop-control-plane-fips, kubernetes-csi-node-driver-registrar-fips, ksops-fips, grafana-influxdb-datasource-fips, crossplane-provider-aws-gamelift, jobset-fips, crossplane-provider-family-aws-fips, kyverno-policy-reporter-plugins-triv...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ds, chainloop-control-plane-fips, kubernetes-csi-node-driver-registrar-fips, ksops-fips, nri-consul, grafana-influxdb-datasource-fips, crossplane-provider-aws-gamelift, jobset-fips, crossplane-provider-family-aws-fips,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ds, chainloop-control-plane-fips, kubernetes-csi-node-driver-registrar-fips, ksops-fips, nri-consul, grafana-influxdb-datasource-fips, crossplane-provider-aws-gamelift, jobset-fips, crossplane-provider-family-aws-fips,...

CVE-2026-78659 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator, kubernetes-csi-external-snapshotter, timoni, harbor, rancher-webhook, crossplane-provider-family-azure, terraform-provider-time, flux-helm-controller, knative-eventing, kyverno-notation-aws, esbuild, keda, opentelemetry-operator,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator, kubernetes-csi-external-snapshotter, timoni, harbor, rancher-webhook, crossplane-provider-family-azure, terraform-provider-time, flux-helm-controller, knative-eventing, kyverno-notation-aws, esbuild, keda, opentelemetry-operator,...

CVE-2026-78663 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator, kubernetes-csi-external-snapshotter, timoni, harbor, rancher-webhook, crossplane-provider-family-azure, terraform-provider-time, flux-helm-controller, knative-eventing, kyverno-notation-aws, esbuild, keda, opentelemetry-operator,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: k8ssandra-operator, kubernetes-csi-external-snapshotter, timoni, harbor, rancher-webhook, crossplane-provider-family-azure, terraform-provider-time, flux-helm-controller, knative-eventing, kyverno-notation-aws, esbuild, keda, opentelemetry-operator,...