GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, swagger, cortex, knative-eventing, kaf, kubernetes-dashboard-auth, kube-state-metrics, terraform-provider-google, terraform-provider-azapi, docker-compose, spicedb, net-kourier, kserve-modelmesh-serving,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, swagger, cortex, knative-eventing, kaf, kubernetes-dashboard-auth, kube-state-metrics, terraform-provider-google, terraform-provider-azapi, docker-compose, spicedb, net-kourier, kserve-modelmesh-serving,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: authservice, cortex, crane, nri-kubernetes, net-kourier, cloudflared, sbom-convert, postgres-operator, smarter-device-manager, container-object-storage-interface, cluster-autoscaler, tigera-operator, aws-application-networking-k8s, rancher-webhook, cilium, trino,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: authservice, cortex, crane, nri-kubernetes, net-kourier, cloudflared, sbom-convert, postgres-operator, smarter-device-manager, container-object-storage-interface, cluster-autoscaler, tigera-operator, aws-application-networking-k8s, rancher-webhook, cilium, trino,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: authservice, cortex, crane, nri-kubernetes, net-kourier, cloudflared, sbom-convert, postgres-operator, smarter-device-manager, container-object-storage-interface, cluster-autoscaler, tigera-operator, aws-application-networking-k8s, rancher-webhook, cilium, trino,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: k8s-metacollector-fips, rancher-security-scan, kyverno-policy-reporter-plugins-trivy-fips, helm-diff-fips, crossplane-provider-aws-s3-fips, contour, victoriametrics-operator-fips, terraform-fips, coredns, s5cmd, vertical-pod-autoscaler, crossplane-provider-gcp-fips,...

ROS-20260310-73-0001

A vulnerability in the Cluster: General component of the MySQL Cluster database management system is related to an access control flaw. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to read, modify, add or delete data or cause a denial of service...

CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

EUVD-2026-10421

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-30887

Summary: CVE-2026-30887 affects OneUptime prior to version 10.0.18, where untrusted Playwright/JavaScript code run in Synthetic Monitors is executed inside the insecure Node.js vm module, allowing a prototype-chain escape (this.constructor.constructor) to reach the host process and execute arbitr...

CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-30887

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

EUVD-2026-10360

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible t...

CVE-2026-3288

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible t...

CVE-2026-3288 ingress-nginx rewrite-target nginx configuration injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible t...

PT-2026-24119

Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to 1.13.7 ingress-nginx versions prior to 1.14.3 Description A security issue exists due to insufficient input validation when processing Ingress resource annotations. An attacker can use the...

GHSA-H343-GG57-2Q67 OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

Summary OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape this.constructor.constructor, an...

PT-2026-24091

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.18 Description OneUptime allows project members to execute custom Playwright/JavaScript code via Synthetic Monitors. This code is executed within the Node.js vm module, which is not a secure sandbox. An attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-3234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modproxycluster. This vulnerability, a Carriage Return Line Feed CRLF injection in the decodeenc function, allows a remote attacker to bypas...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the loadClusterProps function in the FileConfigStore component. An attacker can exfiltrate sensitive server files by setting imq.cluster.url to an arbitrary local path e.g., file:///etc/passwd and then running...