CVE-2026-17544

creationtimestamp| type| source ---|---|--- 2026-07-30 12:17:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2ojh2ibweiexi 2026-07-31 12:40:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrwxyq3z2x23 2026-07-31 23:06:04+00:00| seen|...

CVE-2026-18382 Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...

CVE-2026-18378 Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18378

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18378

The CVE-2026-18378 issue affects the koku-metrics-operator. A vulnerability exists in the CostManagementMetricsConfig custom resource, which allows a user to edit the CR to set an arbitrary upload URL. When authentication.type is token (default), the cluster-global Red Hat Cloud pull-secret beare...

EUVD-2026-51094

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

EUVD-2026-51093

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-22620

creationtimestamp| type| source ---|---|--- 2026-07-30 11:52:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/d557ukhddnxri 2026-07-30 14:30:38+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrunp7jxzj2o...

CVE-2026-44615

creationtimestamp| type| source ---|---|--- 2026-07-30 11:29:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/boip2imn6yi5k...

CVE-2026-16969

creationtimestamp| type| source ---|---|--- 2026-07-30 11:19:57+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrud2b6bws2m 2026-07-30 14:07:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/blcb3neggfspp...

GHSA-WCHH-9X6H-7F6P

creationtimestamp| type| source ---|---|--- 2026-07-30 08:32:07+00:00| seen| https://gist.github.com/alon710/d12f2b2b8a8eb557d027885a6580665a...

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-44101

creationtimestamp| type| source ---|---|--- 2026-07-30 07:58:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrtxrdmjwf2e...

CVE-2024-40842

creationtimestamp| type| source ---|---|--- 2026-07-30 07:43:34+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3mrtwxdov3525...

CVE-2026-64635

CVE-2026-64635 affects Veeam Service Provider Console. An improper handling of the returnUrl parameter in Forgot Password enables an unauthenticated attacker to hijack the password-reset link domain, causing the reset code to be sent to an attacker-controlled host and potentially take over the us...

CVE-2026-1360

creationtimestamp| type| source ---|---|--- 2026-07-30 06:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtr7gmx3j2c...

CVE-2026-51297

creationtimestamp| type| source ---|---|--- 2026-07-30 05:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrtpv7h7o42c...

CVE-2026-17782

Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-45293

creationtimestamp| type| source ---|---|--- 2026-07-30 01:01:13+00:00| seen| https://bsky.app/profile/kitafox.bsky.social/post/3mrtahvnsqn2z 2026-08-18 08:00:03+00:00| seen| Telegram/4XT-JwykIct3xZxWRRH2CZISSgTtNZvfMVYRVt8P8-zCvtWNA 2026-08-18 08:00:03+00:00| seen|...