PT-2026-51967

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where HCI UART PROTO INIT is not cleared when hci register dev fails within the hci uart register dev function. This failure allows incoming UA...

CVE-2026-31426

In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpiecsetup When ecinstallhandlers returns -EPROBEDEFER on reduced-hardware platforms, it has already started the EC and installed the address space handler with the struct acpiec...

EUVD-2026-21684

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

CVE-2026-6105

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

CVE-2026-6105 perfree go-fastdfs-web doInstall InstallController.java improper authorization

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

CVE-2026-6105 perfree go-fastdfs-web doInstall InstallController.java improper authorization

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: helm-operator, chart-testing, flux, kots, flux-source-controller, helm-docs, consul-k8s, k9s, chartmuseum, zarf, linkerd2, cilium-cli, pluto, eksctl, helm, helm-mapkubeapis, k8sgpt, zot, helm-push, headlamp, nova, kube-arangodb, cert-manager-cmctl, helm-set-status, t...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: helm-operator, chart-testing, flux, kots, flux-source-controller, helm-docs, consul-k8s, k9s, chartmuseum, zarf, linkerd2, cilium-cli, pluto, eksctl, helm, helm-mapkubeapis, k8sgpt, zot, helm-push, headlamp, nova, kube-arangodb, cert-manager-cmctl, helm-set-status, t...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, aws-privateca-issuer, malcontent, actions-runner-controller, clickhouse-operator, flux-helm-controller, goreleaser, karpenter, temporal, fluxcd-kustomize-mutating-webhook, go, flux-image-reflector-controller, flux, supercronic,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kbld, litefs, lazydocker, cloud-provider-aws, dapr, flux, nri-postgresql, flux-source-controller, timestamp-authority, gitlab-pages, terraform-docs, azure-workload-identity-webhook, yace, portieris, bento, zot, rqlite, cerbos, opentofu, rancher-helm,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kbld, litefs, lazydocker, cloud-provider-aws, dapr, flux, nri-postgresql, flux-source-controller, timestamp-authority, gitlab-pages, terraform-docs, azure-workload-identity-webhook, yace, portieris, bento, zot, rqlite, cerbos, opentofu, rancher-helm,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: rancher-machine, kubernetes-csi-livenessprobe, lazydocker, nginx-prometheus-exporter, terraform-provider-random, kargo, cloud-provider-aws, dapr, flux, flux-source-controller, jitsucom-bulker, trillian, emissary, x509-certificate-exporter, aws-flb-firehose,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: kbld, litefs, lazydocker, cloud-provider-aws, dapr, flux, nri-postgresql, flux-source-controller, timestamp-authority, gitlab-pages, terraform-docs, azure-workload-identity-webhook, yace, portieris, bento, zot, rqlite, cerbos, opentofu, rancher-helm,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: helm, kubescape, helm-diff-fips, zarf, flux-source-controller, linkerd2-fips, k9s, consul-k8s, cerbos, eksctl, istio, helm-operator-fips, nova, jfrog-cli, kuma, cluster-api-helm-controller-fips, trivy-operator-fips, nova-fips, linkerd2, harbor-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: flux-operator, mountpoint-s3-csi-driver, yunikorn-k8shim, aws-flb-firehose-fips, kyverno-fips, longhorn-instance-manager, grpc-health-probe-fips, knative-operator-fips, victoriametrics-operator, crossplane-provider-aws-backup,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose-fips, grpc-health-probe-fips, kyverno-policy-reporter-plugins-kyverno-fips, aws-load-balancer-controller-fips, kubernetes-csi-external-snapshotter, aws-flb-firehose, kubebuilder, cert-manager-fips, cue, wire-go, envoy-gateway, configmap-reload-fips,...

PT-2026-32126

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

Juju: CloudSpec method leaking cloud credentials

Impact If a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller. The CloudSpec API is called by workers running in the controller to maintain connectio...

EUVD-2026-21364

Juju: CloudSpec method leaking cloud credentials...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the CloudSpec method on the Controller facade. An attacker can obtain sensitive cloud credentials by making an authenticated API call with only basic login permissions, without requiring elevated privileges...