PT-2026-72710

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CXL driver where NULL endpoint decoder pointer holes can be left in the target array of an active auto-assembly region. This occurs when cxl cancel auto attach...

CVE-2026-56860 vulnerabilities

Vulnerabilities for packages: gpu-operator-fips, cluster-proportional-autoscaler-fips, gomplate-fips, fairwinds-gemini-fips, nats-server-fips, sftpgo-plugin-eventsearch, neuvector-dbgen-fips, sonobuoy-fips, crossplane-provider-aws-docdb-fips, mediamtx, goose-fips, crossplane-provider-aws-sfn-fips...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, eks-distro, cluster-autoscaler-fips, gosu, neuvector-fips, eks-distro-fips, syft, grype, cadvisor-fips, k3s, kubernetes, k8s-device-plugin, cadvisor, podman, opentelemetry-collector-contrib-fips, docker, cluster-autoscaler, runc,...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit, sriov-network-device-plugin, buildah, falco-no-driver, kubernetes, grafana-alloy, node-feature-discovery, podman, k3s...

GO-2026-5761 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit, sriov-network-device-plugin, buildah, cadvisor, k8s-device-plugin, falco-no-driver, docker-machine-driver-harvester, node-feature-discovery, podman...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: zarf, kubeflow-pipelines, cloudnative-pg, crossplane-provider-aws-ec2, terraform-provider-grafana, manifest-tool, aws-flb-kinesis, descheduler, jitsucom-bulker, octo-sts, fuse-overlayfs-snapshotter, kaniko, opa-envoy, slsa-verifier, grafana, pgpool2exporter, cri-tool...

dirsearch v0.5.0

dirsearch - Web Path Discovery An advanced web path brute-forcer dirsearch is being actively developed by @maurosoria and @shelld3v. Join the Discord server to communicate with the team. Quick Start dirsearch requires Python 3.11 or higher. root@kitploit: git clone...

CVE-2026-73408

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

Important: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

A Subscription Management tool for finding and reporting Red Hat product usage Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their...

CVE-2026-12236

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

Why API Discovery Is Critical for Modern AppSec Programs

Hidden API Estate And AI-speed Recon Are Reshaping Modern Application Risk Key Takeaways Unknown APIs create unattributed exposure , and such exposure rarely gets tested. Attackers build their own inventory through live reconnaissance; they do not wait for your spreadsheet. API discovery must pul...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478

Fulcio (certificate authority for OpenID Connect) reports a vulnerability in OIDC discovery across versions up to 1.8.5 where cross-host redirects attach Kubernetes ServiceAccount tokens, enabling blind SSRF, JWKS key substitution/poisoning, and potential leakage of tokens to external hosts. The ...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

EUVD-2026-57859

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...