GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: tekton-chains, containerd, vault-benchmark, flux-kustomize-controller, trivy-operator, gitlab-runner, k8sgpt, pulumi-language-yaml, gatus, crossplane-provider-azure-storage, kubernetes-dashboard, prometheus-operator, spire-server, scorecard, splunk-otel-collector,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: containerd, trivy-operator, pulumi-language-yaml, prometheus-operator, kubernetes-dashboard, spire-server, scorecard, openbao, pulumi-kubernetes-operator, k3s, kubescape, istio, fscrypt, prometheus, falco-no-driver, zarf, gitea, pulumi, loki, gomplate, cert-manager,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: containerd, chisel, trivy-operator, rancher, skaffold, external-secrets-operator, nerdctl, prometheus-operator, argocd-image-updater, aactl, kubernetes-dashboard, spire-server, minio, mattermost, helm, k3s, flux, cilium, istio, kubescape, cloud-provider-aws, fscrypt,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: datadog-agent, containerd, pulumi-language-java, guac, trivy-operator, skaffold, external-secrets-operator, podman, pulumi-language-yaml, nerdctl, dagger, prometheus-operator, argocd-image-updater, aactl, kubernetes-dashboard, spire-server, scorecard,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: containerd, rancher, external-secrets-operator, podman, nerdctl, prometheus-operator, aactl, kubernetes-dashboard, spire-server, opentofu, minio, mattermost, helm, k3s, flux, cilium, istio, docker-cli-buildx, cloud-provider-aws, buildah, fscrypt, zot, prometheus, kaf...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: containerd, rancher, external-secrets-operator, podman, nerdctl, prometheus-operator, aactl, kubernetes-dashboard, spire-server, minio, mattermost, helm, k3s, flux, cilium, istio, docker-cli-buildx, cloud-provider-aws, buildah, fscrypt, zot, prometheus, kaf,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: tekton-chains, containerd, vault-benchmark, flux-kustomize-controller, tw, crossplane-provider-family-aws, trivy-operator, gitlab-runner, crossplane-provider-aws-cloudformation, docker-machine-driver-linode, k8sgpt, pulumi-language-yaml, gatus,...

Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF

Summary Hysteria's UDP relay treats the destination address as packet-scoped, but ACL and outbound policy are applied only once when a new UDP session is created. After an authenticated client opens a UDP session using an allowed first destination, later packets in the same Session ID can be sent...

GHSA-VGRC-HQ28-P3XP Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF

Summary Hysteria's UDP relay treats the destination address as packet-scoped, but ACL and outbound policy are applied only once when a new UDP session is created. After an authenticated client opens a UDP session using an allowed first destination, later packets in the same Session ID can be sent...

pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

Summary When an application using Pydantic AI opts a URL into forcedownload='allow-local' which disables the default block on private/internal IPs and runs on a network that routes the affected IPv6 transition forms NAT64- or ISATAP-configured networks, the cloud-metadata blocklist could be...

GHSA-CG7W-RG45-PC59 pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)

Summary When an application using Pydantic AI opts a URL into forcedownload='allow-local' which disables the default block on private/internal IPs and runs on a network that routes the affected IPv6 transition forms NAT64- or ISATAP-configured networks, the cloud-metadata blocklist could be...

GHSA-XHQX-MGH3-3H7Q Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

Summary backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with cancreatestoragevolumes permission on any project ca...

Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

Summary backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with cancreatestoragevolumes permission on any project ca...

GHSA-4XG6-52MH-FPW8 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

Summary backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An authenticated user with cancreateinstances permission on any project can crash...

Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

Summary backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An authenticated user with cancreateinstances permission on any project can crash...

MAL-2026-6530 Malicious code in xrblocks-remote-control (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e20199ccf4c5557bf9d6bd0f17f0f74b47aa54389f22247523fb9145ef29def Package xrblocks-remote-control ships a bin script that, when invoked including via npx or unintended resolution against the xrblocks name, POSTs the...

Malicious code in xrblocks-remote-control (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e20199ccf4c5557bf9d6bd0f17f0f74b47aa54389f22247523fb9145ef29def Package xrblocks-remote-control ships a bin script that, when invoked including via npx or unintended resolution against the xrblocks name, POSTs the...

Security Bulletin: Vulnerabilities in lodash, cryptography and axios might affect IBM Storage Defender Sentinel Anomaly Scan Engine.

Summary IBM Storage Defender Sentinel Anomaly Scan Engine can be affected by lodash, cryptography and axios. Vulnerabilities include allowing an attacker to perform prototype pollution, create buffer overflows, improper validation of certificates and connect to internal services. More details are...

CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...

DEBIAN-CVE-2026-9640

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy...