CVE-2026-122308

Kyverno versions prior to 1.19.2 are vulnerable to an authorization bypass in the Generation Handler due to label spoofing. Users with create/update permissions can bypass security by using crafted generate.kyverno.io labels on a ConfigMap. This allows attackers to trigger synchronized generate p...

CLSA-2026-1784533387 golang: Fix of CVE-2026-39821

CVE-2026-39821: reject all-ASCII xn-- labels in the vendored golang.org/x/net/idna to prevent Punycode label spoofing...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...