143 matches found
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: rabbitmq-cluster-operator, crossplane-provider-aws-lightsail-fips, zitadel, step-fips, kubeflow-pipelines-fips, local-path-provisioner, envconsul-fips, crossplane-provider-aws-pinpoint, flux-helm-controller, crossplane-provider-aws-inspector2-fips, databricks-cli,...
GO-2026-6610 vulnerabilities
Vulnerabilities for packages: postgres-operator, rancher, rancher-webhook, snyk-cli, vt-cli, skaffold, syft, crossplane-provider-aws-cloudwatchlogs, restic, tflint, ingress-nginx-controller, falcosidekick, tkn, kuberay-operator, aws-node-termination-handler, sops, azure-service-operator,...
CVE-2026-78660 vulnerabilities
Vulnerabilities for packages: postgres-operator, rancher, rancher-webhook, snyk-cli, vt-cli, skaffold, syft, crossplane-provider-aws-cloudwatchlogs, restic, tflint, ingress-nginx-controller, falcosidekick, tkn, kuberay-operator, aws-node-termination-handler, sops, azure-service-operator,...
WordPress Geliver Akıllı Kargo Pazaryeri plugin 3.0.0-3.1.0 - Unauthenticated API Key Disclosure vulnerability
Unauthenticated API Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Geliver Akıllı Kargo Pazaryeri versions 3.0.0-3.1.0...
CVE-2026-103378
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...
CVE-2026-103378
The Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0-3.1.0 ) contains a vulnerability where it fails to restrict unauthenticated access to a log file stored in a web-accessible directory. The plugin writes the site's carrier integration key into this file during unauthenticated req...
EUVD-2026-94174
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...
CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...
CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...
PT-2026-107397
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...
CVE-2026-103378: Exposure of Sensitive Information to an Unauthorized Actor
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...
GO-2026-6497 vulnerabilities
Vulnerabilities for packages: cluster-api-helm-controller, kube-arangodb, k9s, helm-set-status, kyverno-notation-aws, tigera-operator, rancher-helm, gitness, maru, cert-manager-cmctl, flux-helm-controller, k8sgpt, helm-push, opentofu, helm-mapkubeapis, kargo, xeol, manifest-tool...
GHSA-PG57-6JWG-Q645 vulnerabilities
Vulnerabilities for packages: rancher, buildkitd, helm-set-status, docker-compose, kaniko, fuse-overlayfs-snapshotter, kubescape, headlamp, helm-push, skaffold, helm-mapkubeapis, syft, cluster-api-helm-controller, spegel, steampipe, zot, neuvector-scanner, kargo, newrelic-infrastructure-agent,...
CVE-2026-53493 vulnerabilities
Vulnerabilities for packages: rancher, buildkitd, helm-set-status, docker-compose, kaniko, fuse-overlayfs-snapshotter, kubescape, headlamp, helm-push, skaffold, helm-mapkubeapis, syft, cluster-api-helm-controller, spegel, steampipe, zot, neuvector-scanner, kargo, newrelic-infrastructure-agent,...
SUSE CVE-2026-42350
Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2...
GO-2026-6301 Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo
Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter in github.com/akuity/kargo...
GHSA-G7GW-M874-7RMF Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...
Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...
EUVD-2026-28857
Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: kube-mgmt-fips, chaos-mesh, cloudbeat-fips, k9s-fips, tigera-operator-fips, kots, gogatekeeper, gitness, helm-push, argocd-image-updater-fips, kubescape, headlamp, ocm-cli, consul-k8s, envoy-gateway, trivy-operator, oras-fips, kgateway-fips, kube-arangodb,...