10603 matches found
CVE-2026-75033: Authorization Bypass Through User-Controlled Key
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...
PT-2026-85211
Name of the Vulnerable Software and Affected Versions Kibana versions 8.0.0 through 8.19.20 Kibana versions 9.0.0 through 9.4.5 Kibana versions 9.5.0 through 9.5.2 Description Incorrect authorization in Kibana allows for privilege escalation through input data manipulation. The system fails to...
PT-2026-85063
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...
CVE-2026-75036: Server-Side Request Forgery (SSRF)
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...
EUVD-2026-58518
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs...
GHSA-QH9R-J7RP-4X2M OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...
CVE-2026-82293
Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...
SUSE CVE-2026-84195
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...
CVE-2026-84372
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...
Exploit for Eval Injection in Langflow
CVE-2025-62593 — Ray Unauthenticated RCE Exploit Overview...
CVE-2026-84195
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...
EUVD-2026-69032
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...
CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...
CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall
Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...
CLEANSTART-2026-IW50648 Security fixes in cluster-autoscaler 1.36.1-r2
Package cluster-autoscaler version 1.36.1-r2 fixes 4 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2026-73500, ghsa-gcjh-h69q-9w9g...
CLEANSTART-2026-DB39840 Security fixes in cluster-autoscaler 1.36.1-r1
Package cluster-autoscaler version 1.36.1-r1 fixes 7 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-56864, CVE-2026-56865, CVE-2026-39883, CVE-2026-56852...
CLEANSTART-2026-BG12778 Security fixes in cluster-autoscaler 1.35.2-r1
Package cluster-autoscaler version 1.35.2-r1 fixes 29 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...