8824 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-34179
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH...
[SECURITY] Fedora 42 Update: corosync-3.1.9-4.fc42
This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...
CVE-2026-35206 vulnerabilities
Vulnerabilities for packages: consul-k8s, k9s, kots, harbor, cilium-cli, envoy-gateway, cerbos, zarf, chart-testing, linkerd2, rancher-fleet, kubescape, helm-set-status, kuma, tw, eksctl, helm-operator, pluto, trivy-operator, helm-push, zot, istio, nova, headlamp, cert-manager-cmctl,...
GHSA-HR2V-4R36-88HR vulnerabilities
Vulnerabilities for packages: consul-k8s, k9s, kots, harbor, cilium-cli, envoy-gateway, cerbos, zarf, chart-testing, linkerd2, rancher-fleet, kubescape, helm-set-status, kuma, tw, eksctl, helm-operator, pluto, trivy-operator, helm-push, zot, istio, nova, headlamp, cert-manager-cmctl,...
GHSA-HR2V-4R36-88HR vulnerabilities
Vulnerabilities for packages: helm-exporter-fips, harbor, cluster-api-helm-controller, helm-diff-fips, chart-testing-fips, harbor-fips, rancher-fleet-fips, chartmuseum-fips, helm-docs, k9s-fips, tigera-operator, trivy-operator, trivy-operator-fips, jfrog-cli, kube-arangodb-fips, pluto-fips,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: net-kourier, cilium, percona-server-mongodb-operator, victoriametrics-operator, nri-mysql, stern, stakater-reloader, chart-testing, mkcert, go-discover, aactl, smokescreen, pdfcpu, php-fpmexporter, eksctl, flux-helm-controller, dive, promxy, terraform-provider-azapi,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: net-kourier, cilium, percona-server-mongodb-operator, victoriametrics-operator, nri-mysql, stern, stakater-reloader, chart-testing, go-discover, aactl, smokescreen, pdfcpu, php-fpmexporter, eksctl, flux-helm-controller, dive, promxy, terraform-provider-azapi,...
GHSA-JRG3-GFJW-HM96 vulnerabilities
Vulnerabilities for packages: net-kourier, cilium, percona-server-mongodb-operator, victoriametrics-operator, nri-mysql, stern, stakater-reloader, chart-testing, go-discover, aactl, smokescreen, pdfcpu, php-fpmexporter, eksctl, flux-helm-controller, dive, promxy, terraform-provider-azapi,...
CVE-2026-35206 vulnerabilities
Vulnerabilities for packages: helm-exporter-fips, harbor, cluster-api-helm-controller, helm-diff-fips, chart-testing-fips, harbor-fips, rancher-fleet-fips, chartmuseum-fips, helm-docs, k9s-fips, tigera-operator, trivy-operator, trivy-operator-fips, jfrog-cli, kube-arangodb-fips, pluto-fips,...
CVE-2026-32288 vulnerabilities
Vulnerabilities for packages: openbao, amazon-ecs-agent-fips, elastic-agent, spegel-fips, kbld-fips, opa-fips-envoy, act, atlantis-fips, libnvidia-container-fips, nsc, gosu, nuclei, zot, docker-cli-fips, cloud-provider-aws-fips, kube-state-metrics, prometheus-podman-exporter-fips, datadog-agent,...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: openbao, amazon-ecs-agent-fips, elastic-agent, spegel-fips, kbld-fips, opa-fips-envoy, act, atlantis-fips, libnvidia-container-fips, nsc, gosu, nuclei, zot, docker-cli-fips, cloud-provider-aws-fips, kube-state-metrics, prometheus-podman-exporter-fips, datadog-agent,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: authservice, jupyterhub-k8s-image-awaiter-fips, openbao, vault-k8s, crossplane-provider-aws-rds-fips, swagger, falco-exporter, opentelemetry-operator, aws-privateca-issuer, amazon-ecs-agent-fips, db-operator, secrets-store-csi-driver-provider-aws, yunikorn-k8shim-fip...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: authservice, crossplane-provider-aws-rds-fips, spegel-fips, crossplane-provider-aws-elbv2, kbld-fips, nsc, cert-manager-google-cas-issuer-fips, go-md2man, virt-controller-fips, kyverno-policy-reporter-plugins-trivy-fips, gosu, flux-image-reflector-controller,...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the AdminService/StreamWorkflowReplicationMessages endpoint. An attacker can access replication streams and exfiltrate data by connecting to the frontend gRPC server without providing...
EUVD-2026-21607
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests...
CVE-2026-5724
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests...
EUVD-2026-20876
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin...
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
Summary A restricted TLS certificate user can escalate to cluster admin by changing their certificate type from client to server via PUT/PATCH to /1.0/certificates/fingerprint. The non-admin guard and reset block in doCertificateUpdate fail to validate or reset the Type field, allowing a...
GHSA-C3H3-89QF-JQM5 LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
Summary A restricted TLS certificate user can escalate to cluster admin by changing their certificate type from client to server via PUT/PATCH to /1.0/certificates/fingerprint. The non-admin guard and reset block in doCertificateUpdate fail to validate or reset the Type field, allowing a...