CVE-2026-16456: Unintended Proxy or Intermediary

A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to rea...

The vulnerabilities of the Ingress components and Custom Resource Definitions (CRDs) of the NGINX Ingress Controller platform allow a malicious actor to insert arbitrary configuration directives into NGINX, gain unauthorized access to file creation and deletion operations, or trigger service failures.

The vulnerability of the Ingress components and Custom Resource Definitions CRDs of the NGINX Ingress Controller monitoring and management platform is related to the lack of measures taken to neutralize special elements during the processing of string values. Exploiting this vulnerability allows ...

CVE-2026-15467: Incorrect Privilege Assignment

A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...

The vulnerability of the Ingress and TransportServer components of the NGINX Ingress Controller platform allows a attacker to cause service interruptions.

The vulnerability of the Ingress and TransportServer components of the NGINX Ingress Controller monitoring and management platform is related to a pointer arithmetic error. Exploiting this vulnerability could allow an attacker to cause service interruptions...

CVE-2026-19354

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, grafana-alloy-fips, skaffold, jfrog-cli, argo-workflows, witness, trivy, cerbos, flux-source-controller-fips, gitlab-rails-ce, flux-notification-controller-fips, flux-source-controller, argo-events, teleport, kubevela-fips, k9s, guac, flux,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, grafana-alloy-fips, skaffold, jfrog-cli, argo-workflows, witness, trivy, cerbos, flux-source-controller-fips, gitlab-rails-ce, flux-notification-controller-fips, flux-source-controller, argo-events, teleport, kubevela-fips, k9s, guac, flux,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, grafana-alloy-fips, skaffold, jfrog-cli, argo-workflows, witness, trivy, cerbos, flux-source-controller-fips, gitlab-rails-ce, flux-notification-controller-fips, flux-source-controller, argo-events, teleport, kubevela-fips, k9s, guac, flux,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, grafana-alloy-fips, skaffold, jfrog-cli, argo-workflows, witness, trivy, cerbos, flux-source-controller-fips, gitlab-rails-ce, flux-notification-controller-fips, flux-source-controller, argo-events, teleport, kubevela-fips, k9s, guac, flux,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: flux, nfpm, argo-workflows, boring-registry, grafana-alloy, tfsec, pulumi-language-java, steampipe, cerbos, gitea, act, src-fingerprint, syft, gptscript, kubescape, nuclei, dagger, pulumi-language-yaml, kyverno, goreleaser, argo-events, kaniko, kargo, skaffold,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: flux, nfpm, argo-workflows, boring-registry, grafana-alloy, tfsec, pulumi-language-java, steampipe, cerbos, gitea, act, src-fingerprint, syft, gptscript, kubescape, nuclei, dagger, pulumi-language-yaml, kyverno, goreleaser, argo-events, kaniko, kargo, skaffold,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: flux, nfpm, argo-workflows, boring-registry, grafana-alloy, tfsec, pulumi-language-java, steampipe, cerbos, gitea, act, src-fingerprint, syft, gptscript, kubescape, nuclei, dagger, pulumi-language-yaml, kyverno, goreleaser, argo-events, kaniko, kargo, skaffold,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: flux, nfpm, argo-workflows, boring-registry, grafana-alloy, tfsec, pulumi-language-java, steampipe, cerbos, gitea, act, src-fingerprint, syft, gptscript, kubescape, nuclei, dagger, pulumi-language-yaml, kyverno, goreleaser, argo-events, kaniko, kargo, skaffold,...

CVE-2025-71412

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency...

CVE-2025-71411

Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency...

CVE-2025-71410

Unnumbered Disconnect U DISC and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio...

CVE-2025-71409 No Authentication for Very High Frequency Data Link messages used in CPDLC

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency...

CVE-2025-71410

The CVE-2025-71410 issue affects systems handling Aviation Very High Frequency Link Control (VHF L-C) and Unnumbered Disconnect (U DISC) frames used by CPDLC. Described vulnerability can terminate sessions and cause loss of CPDLC functions, forcing a reversion to voice comms and increasing contro...

CVE-2025-71410

Unnumbered Disconnect U DISC and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio...

EUVD-2025-210652

Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency...