EUVD-2026-60452

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

CVE-2026-66795 Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

CVE-2026-66795 Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

CVE-2026-66795

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: nfpm, tekton-pipelines, bank-vaults, cluster-api-aws-controller-fips, ipfs-cluster, crossplane-provider-aws-kafkaconnect, kubernetes-csi-livenessprobe-fips, crossplane-provider-aws-monolith, crossplane-provider-aws-transcribe-fips, jaeger-operator, descheduler,...

GO-2026-4446 vulnerabilities

Vulnerabilities for packages: grafana...

GO-2026-5363 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: apko, policy-controller, zarf, vexctl, goreleaser, melange, zot, aactl, ko, spire-server, flux-source-controller, kubescape, skaffold, neuvector-sigstore-interface, gitsign, falcoctl, tkn, tekton-chains, wolfictl, slsa-verifier...

Oracle Linux 8 : bind9.16 (ELSA-2026-54509)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54509 advisory. - Fix NSEC3 signer validation CVE-2026-10723 - Reject out-of-zone NSEC next owner names CVE-2026-13321 - Fix CVE-2026-11622: reference-counted DNS cac...

Imperva API Security Token & Authentication Risk Report: Nearly 40% of APIs Face Multiple Authentication Risks

Every year, the security industry publishes benchmark reports built more or less the same way: pick a handful of common vulnerabilities, measure how often they show up, publish the percentages, and move on. We just finished our second year running one of those reports — and the most important thi...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

Duplicate Advisory: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-34fj-mwm6-fjfg. This link is maintained to preserve external references. Original Description siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to...

CVE-2026-18676

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

EUVD-2026-57423

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18676

The CVE-2026-18676 entry concerns Kong Mesh by exposing the admin bootstrap token and signing keys via a CORS misconfiguration in the default kuma-cp configuration. The vulnerability arises because a cross-origin fetch() from a malicious page can retrieve the admin JWT and signing material when t...

CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

PT-2026-71207

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-72793: Insufficiently Protected Credentials

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with...

CVE-2026-18676: Origin Validation Error

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...