CVE-2026-1580 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

CVE-2026-1580

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

CVE-2026-1580 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: mariadb-operator, gitlab-operator-fips, opentelemetry-operator, percona-server-mongodb-operator-fips, opentelemetry-operator-fips, step-issuer-fips, aws-privateca-issuer-fips, cert-manager-csi-driver, cert-manager-webhook-pdns, cert-manager-csi-driver-fips,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, crossplane-provider-aws-cloudformation, traefik, kapp-controller, timoni, spqr, gogatekeeper, extism, paranoia, amazon-cloudwatch-agent-operator, ksops, gcp-compute-persistent-disk-csi-driver, kubeflow, kubernetes-dashboard-api, cass-operator, lazygit,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-api, langfuse, terraform-mcp-server, minio-object-browser, terraform-docs, rancher-telemetry, croc, crossplane-provider-azure-sql, wazero, scorecard, timescaledb-tune, fuse-overlayfs-snapshotter, mesosphere-vsphere-csi, aws-flb-kinesis,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-api, langfuse, terraform-mcp-server, minio-object-browser, terraform-docs, rancher-telemetry, croc, crossplane-provider-azure-sql, wazero, scorecard, timescaledb-tune, fuse-overlayfs-snapshotter, mesosphere-vsphere-csi, aws-flb-kinesis,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: ipfs-cluster, crossplane-provider-aws-cloudformation, traefik, kapp-controller, timoni, spqr, gogatekeeper, extism, paranoia, amazon-cloudwatch-agent-operator, ksops, gcp-compute-persistent-disk-csi-driver, kubeflow, kubernetes-dashboard-api, cass-operator, lazygit,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, crossplane-provider-aws-cloudformation, traefik, kapp-controller, timoni, spqr, gogatekeeper, extism, paranoia, amazon-cloudwatch-agent-operator, ksops, gcp-compute-persistent-disk-csi-driver, kubeflow, kubernetes-dashboard-api, cass-operator, lazygit,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kubernetes-replicator, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, cosign, nfs-subdir-external-provisioner, gostatsd, beats-fips, kong-ingress-controller-fips, kubernetes-event-exporter, prometheus-fips,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kubernetes-replicator, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, cosign, nfs-subdir-external-provisioner, gostatsd, beats-fips, kong-ingress-controller-fips, kubernetes-event-exporter, prometheus-fips,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, kubernetes-replicator, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, cosign, nfs-subdir-external-provisioner, gostatsd, velero-plugin-for-csi-fips, beats-fips, kong-ingress-controller-fips,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, kubernetes-replicator, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, cosign, nfs-subdir-external-provisioner, gostatsd, velero-plugin-for-csi-fips, beats-fips, kong-ingress-controller-fips,...

CVE-2025-61731 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, kubernetes-replicator, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, cosign, nfs-subdir-external-provisioner, gostatsd, velero-plugin-for-csi-fips, beats-fips, kong-ingress-controller-fips,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kubernetes-replicator, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, cosign, nfs-subdir-external-provisioner, gostatsd, beats-fips, kong-ingress-controller-fips, kubernetes-event-exporter, prometheus-fips,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, kubernetes-replicator, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, cosign, nfs-subdir-external-provisioner, gostatsd, velero-plugin-for-csi-fips, beats-fips, kong-ingress-controller-fips,...

Researchers Uncover Chrome Extensions Abusing Affiliate Links and Stealing ChatGPT Access

Cybersecurity researchers have discovered malicious Google Chrome extensions that come with capabilities to hijack affiliate links, steal data, and collect OpenAI ChatGPT authentication tokens. One of the extensions in question is Amazon Ads Blocker ID: pnpchphmplpdimbllknjoiopmfphellj, which...

Ex-Google Engineer Convicted for Stealing AI Secrets for China Startup

A former Google engineer accused of stealing thousands of the company's confidential documents to build a startup in China has been convicted in the U.S., the Department of Justice DoJ announced Thursday. Linwei Ding aka Leon Ding, 38, was convicted by a federal jury on seven counts of economic...

Unspecified Vulnerability in Oracle MySQL (CNVD-2026-16627)

Oracle MySQL is an open source relational database management system from Oracle. A security vulnerability exists in Oracle MySQL for MySQL Server and MySQL Cluster, which can be exploited by attackers to cause a denial of service...

CVE-2026-24748

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.8.7, 1.7.7, and 1.6.3, a bug was found with authentication checks on the GetConfig API endpoint. This allowed unauthenticated users to access this endpoint by specifying an Authorization header with any non-empty...