PT-2026-52543

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal...

CVE-2026-56769: Server-Side Request Forgery (SSRF)

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal...

CVE-2026-13201 Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses OPATH|ONOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel...

CVE-2026-13201

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses OPATH|ONOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel...

CVE-2026-13201

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses OPATH|ONOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the notify server process. An attacker can disrupt the lifecycle management of co-located virtual machines by sending forged domain lifecycle events through a legitimate Unix socket after gaining shell access...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the OpenAtNoFollow process. An attacker can cause unintended file ownership or permission changes on host files by placing a symlink in the virt-launcher filesystem, which is then followed via...

langchain-visualizer (0.0.18), pod-gpt (>=0.0.1, <=0.0.7) +1 more potentially affected by CVE-2026-55443 via langchain (0.0.125)

langchain PYPI version 0.0.125 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - langchain-visualizer 0.0.18 - pod-gpt =0.0.1, =0.0.7 - vcr-langchain 0.0.21 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

CVE-2026-50195

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods ca...

containerd: CRI checkpoint import allows local image tag poisoning

Impact containerd's CRI checkpoint import process contains a vulnerability where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the group parsing process. An attacker can cause memory exhaustion and disrupt the container runtime API by supplying a maliciously crafted image that triggers unbounded parsing,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the group parsing process. An attacker can cause memory exhaustion and disrupt the container runtime API by supplying a maliciously crafted image that triggers unbounded parsing,...

PT-2026-51058

Name of the Vulnerable Software and Affected Versions containerd versions prior to 2.1.9 containerd versions prior to 2.2.5 containerd versions prior to 2.3.2 Description The CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image...

langchain-visualizer (0.0.18), pod-gpt (>=0.0.1, <=0.0.7) +1 more potentially affected by CVE-2026-55443 via langchain (0.0.125)

langchain PYPI version 0.0.125 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - langchain-visualizer 0.0.18 - pod-gpt =0.0.1, =0.0.7 - vcr-langchain 0.0.21 Source cves: CVE-2026-55443 Source advisory:...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the genDeploymentSpec and genDeploymentSpec pod construction paths in the newdeploy and generic pool components. An attacker can obtain the fission-fetcher service account token from the user-co...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the genDeploymentSpec and genDeploymentSpec pod construction paths in the newdeploy and generic pool components. An attacker can obtain the fission-fetcher service account token from the user-co...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the builder process. An attacker can execute arbitrary commands within the builder pod context by supplying crafted values to the Environment.spec.builder.command field when creating or updating Environment CRDs in...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via the MergePodSpec process. An attacker can gain unauthorized access to cluster nodes and potentially take control of the entire cluster by injecting malicious fields into the podSpec configuration...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management via the MergePodSpec process. An attacker can gain unauthorized access to cluster nodes and potentially take control of the entire cluster by injecting malicious fields into the podSpec configuration...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to improper validation of user-supplied pod specifications in the Environment process. An attacker can gain elevated privileges and potentially escape the node by specifying dangerous fields such as...