CVE-2026-70666

CVE-2026-70666 is a Server-Side Request Forgery (SSRF) in Lemur (Netflix's TLS certificate manager), rated CVSS 7.4 HIGH . Two defects combine: the acme_url allowlist is validated only at authority creation, not on the PUT /api/1/authorities/ update path, and the ACME client follows server-suppli...

CVE-2026-55163

Lemur (Netflix TLS certificate management tool) has an authorization bypass in PUT /api/1/roles/ (lemur/roles/views.py:298): RoleMemberPermission uses OR-semantics, so any existing role member can add/remove other users and rename the role. The companion DELETE handler already required admin perm...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-66780

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

CVE-2026-50167

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

GHSA-P23G-MVHJ-JH3J GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString paths in ConnectionFactory.java. An attacker can intercept and tamper with AMQP traffic by presenting any certificate...

CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

EUVD-2026-61078

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

CVE-2026-66780

Submariner-operator contains a flaw where the submariner-k8s-broker-cluster Role, assigned to joined clusters, holds excessive permissions. A compromised cluster can overwrite other clusters' endpoint information, redirecting inter-cluster tunnel traffic and enabling a Man-in-the-Middle (MITM) at...

CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

DEBIAN-CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-66780

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

CVE-2026-50578 ePA 3.x Integration: TLS Certificate Verification Universally Disabled

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in...

EUVD-2026-61056

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in...

CVE-2026-50578

Versions of ePA 3.x Integration before 1.3.0 disable TLS certificate verification (self.session.verify=False) in app/vau/VAUProtokoll.py and app/konnektor/Konnektor.py, allowing a network attacker to present arbitrary certificates, terminate TLS, and intercept or observe mutual-TLS smartcard exch...

CVE-2026-52723

In ePA 3.x Integration versions prior to 1.3.0, app/vau/VAUProtokoll.py validates the VAU server certificate without anchoring it to independent trusted material, creating a circular trust relationship. Combined with disabled TLS certificate verification, a network-positioned attacker can interce...