CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: grype-db, kubescape-server, newrelic-infrastructure-agent-fips, opa-fips, helm-exporter-fips, chainctl, kubevela, containerd-fips, datadog-agent-fips, spegel, tigera-operator-fips, consul-k8s, syft, tw, chaos-mesh, helm-fips, kubevela-fips, skaffold-fips,...

Mattermost Server 10.11.x <= 10.11.13 / 11.5.x <= 11.5.1 Multiple Vulnerabilities (MMSA-2026-00570 / MMSA-2026-00575 / MMSA-2026-00582 / MMSA-2026-00622)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities: - Mattermost fails to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an...

GHSA-CHF8-4HV6-8PG6 Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

Summary The Fission storagesvc component registers archive CRUD handlers /v1/archive GET / POST / DELETE and /v1/archives list directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the storagesvc ClusterIP — including any other workload in th...

MAL-2026-4617 Malicious code in n8n-nodes-pentest-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a813bc4a209e75b50151451de1c2a3c4a7e916b181b314416eafc43492b4eb5 On npm install, the package's postinstall script runs a shell pipeline that reads the Kubernetes service-account token from...

PT-2026-42619

Summary mcp-server-kubernetes exposes three environment variables ALLOW ONLY READONLY TOOLS, ALLOW ONLY NON DESTRUCTIVE TOOLS, ALLOWED TOOLS documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer tools/list...

PT-2026-42684

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.23.0 Description The storagesvc component registers archive CRUD handlers on its HTTP router without authentication or authorization. This allows any caller capable of reaching the storagesvc ClusterIP, such as othe...

org.glassfish.main.admingui:admingui (>=7.0.0-m10, <=9.0.0-m1), org.glassfish.main.admingui:console-cluster-plugin (>=7.0.0-m10, <=9.0.0-m1) +20 more potentially affected by CVE-2026-2586 via org.glassfish.jsftemplating:jsftemplating (>=4.0.0, <=4.1.0)

org.glassfish.jsftemplating:jsftemplating MAVEN version =4.0.0, =7.0.0-m10, =7.0.0-m10, =7.0.16, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =9.0.0-m1 and more Source cves: CVE-2026-2586 Sour...

ANT-2026-DJBBBBPE · temporalio/temporal · Broken Access Control

broken-access-control low CVE-2026-5199 Severity Claude critical · Security research firm - · Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-DJBBBBPE: Cross-namespace manipulation including deletion of workflows on the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring: Fixed a fget leak when the file system does not support nowait buffered reads. Heming reported a bug when using iouring for link-cp operations on ocfs2. 1 The following steps can reproduce this bug: mount -t ocfs2 /dev/v...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: A bug that led to out-of-bounds access was fixed in the mchpipcgetclusteraggrirq function. The clustercfg array is dynamically allocated to hold per-CPU configuration structures. Its size is determined by t...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021655)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021655 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2getinitinode fails syzbot is reporting busy inodes after unmount, for...

PT-2026-78511

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Wazuh versions 5.0.0-beta1 through 5.0.0-beta2 Description An issue exists where the cluster.unmerge info function in framework/wazuh/core/cluster/cluster.py constructs paths using peer-controlled merge type...

Veritas InfoScale CmdServer Access Control Vulnerability

Veritas InfoScale CmdServer is a command execution and remote management service component provided by Veritas Corporation in the US, designed for InfoScale cluster environments. Versions of Veritas InfoScale CmdServer prior to 7.4.2 contained an access control vulnerability, which was caused by...

Veritas Technologies Infoscale Operations Manager: Cross-site Request Forgery Vulnerability

Veritas Technologies Infoscale Operations Manager is a software developed by Veritas Technologies in the United States, used for managing the entire InfoScale deployment. This software offers features such as multi-cluster management, custom interfaces, and centralized audit logging. Version 9.1....

org.glassfish.main.admingui:console-cluster-plugin (4.0-b33), org.glassfish.main.admingui:console-common-full-plugin (4.0-b33) +6 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (4.0-b33)

org.glassfish.main.admingui:console-common MAVEN version 4.0-b33 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 4.0-b33 -...

org.glassfish.main.admingui:console-cluster-plugin (5.0.1), org.glassfish.main.admingui:console-common-full-plugin (5.0.1) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.0.1)

org.glassfish.main.admingui:console-common MAVEN version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.0.1 -...

org.glassfish.main.admingui:console-cluster-plugin (5.1.0-rc2), org.glassfish.main.admingui:console-common-full-plugin (5.1.0-rc2) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.1.0-rc2)

org.glassfish.main.admingui:console-common MAVEN version 5.1.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.1.0-rc2 -...

org.glassfish.main.admingui:console-cluster-plugin (5.1.0), org.glassfish.main.admingui:console-common-full-plugin (5.1.0) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.1.0)

org.glassfish.main.admingui:console-common MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.1.0 -...

org.glassfish.main.admingui:console-cluster-plugin (6.0.0-rc1), org.glassfish.main.admingui:console-common-full-plugin (6.0.0-rc1) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.0.0-rc1)

org.glassfish.main.admingui:console-common MAVEN version 6.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.0.0-rc1 -...

org.glassfish.main.admingui:console-cluster-plugin (6.1.0), org.glassfish.main.admingui:console-common-full-plugin (6.1.0) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.1.0)

org.glassfish.main.admingui:console-common MAVEN version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.1.0 -...