CVE-2026-19188 Haiwell IoT Cloud HMI Gateway OS Command Injection

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

CVE-2026-19188

CVE-2026-19188 affects the Haiwell IoT Cloud HMI Gateway. The vulnerability is an OS command injection in the Net Check feature accessed via the /setting endpoint, where the cmdPing Socket.io event does not properly sanitize user input, allowing an attacker to inject and execute arbitrary OS comm...

CVE-2026-19188

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

GO-2025-3418 vulnerabilities

Vulnerabilities for packages: envoy-gateway...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, commercial-grafana, commercial-expanso-edge, kots, kine, commercial-chainloop-backend, spire-server, envoy-gateway, k3s...

GO-2026-4771 vulnerabilities

Vulnerabilities for packages: envoy-gateway-fips, vault-fips, teleport, commercial-grafana, gitaly, vault...

GO-2025-3942 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway, kubernetes-dns-node-cache, eks-distro, k8sgateway-fips, cloudflared, kubernetes-dns-node-cache-fips, eks-distro-fips, cloudflared-fips...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: gitness, envoy-gateway-fips, argocd-image-updater, argocd-image-updater-fips, gitlab-rails-ce, kots, portieris-fips, portieris, zot, gitlab-rails-ce-fips, envoy-gateway...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: gitness, envoy-gateway-fips, argocd-image-updater, argocd-image-updater-fips, gitlab-rails-ce, kots, portieris-fips, portieris, zot, gitlab-rails-ce-fips, envoy-gateway...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: xeol-fips, cloudbeat-fips, trivy-fips, consul-k8s-fips, chartmuseum-fips, drone, teleport, argocd-image-updater-fips, ocm-cli, kyverno-notation-aws-fips, zarf, conftest-fips, redpanda-operator, oras-fips, gogatekeeper, argo-cd-fips, envoy-gateway, oras,...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: nuclei, undock, k9s, filebrowser, trivy-operator, vcluster, gptscript, gitness, terragrunt, nsc, podman, kubescape-operator, opentofu, trufflehog, terraform, grafana-alloy, steampipe, zarf, rancher-fleet, gitleaks, trivy, envoy-gateway, xeol, guac, tflint, zot...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: envoy-gateway, k3s, spire-server, kine, kots...

GO-2025-3418 vulnerabilities

Vulnerabilities for packages: envoy-gateway...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, k9s, chartmuseum, flux-helm-controller, flux-source-controller, kots, helm-operator, cerbos, pluto, rancher-helm, k8sgpt, cluster-api-helm-controller, cilium-cli, eksctl, k8ssandra-client, chart-testing, helm-docs, tw, zarf, istio, rancher-fleet,...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: envoy-gateway, portieris, argocd-image-updater, zot, kots, gitness...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: envoy-gateway, portieris, argocd-image-updater, zot, kots, gitness...

WordPress Payment Gateway for PayPal on WooCommerce plugin < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability

Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Gateway for PayPal on WooCommerce versions 9.2.1...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...