CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all network interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection . Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and Retry...

EUVD-2026-67808

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

PT-2026-83300

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: cosmo-router, kyverno, fluxcd-kustomize-mutating-webhook, karma-fips, zitadel, fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, karma, telegraf...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: cosmo-router, kyverno, fluxcd-kustomize-mutating-webhook, karma-fips, zitadel, fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, karma, telegraf...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: cosmo-router, kyverno, fluxcd-kustomize-mutating-webhook, karma-fips, zitadel, fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, karma, telegraf...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: karma, telegraf, kyverno, fluxcd-kustomize-mutating-webhook...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: karma, telegraf, kyverno, fluxcd-kustomize-mutating-webhook...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: karma, telegraf, kyverno, fluxcd-kustomize-mutating-webhook...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: git-sync, kapp, whereabouts, azure-service-operator, cilium-cli, spegel, azure-workload-identity-webhook, ipfs-cluster, crossplane-provider-aws-kinesis, newrelic-fluent-bit-output, nginx-prometheus-exporter, clickhouse-operator, ghaudit, azcopy, pguser, blobfuse2,...

CVE-2026-55707: Incorrect Authorization

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...

CVE-2026-54725

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

PT-2026-66831

Name of the Vulnerable Software and Affected Versions vault-secrets-webhook versions prior to 1.23.1 Description The software reads the vault.security.banzaicloud.io/vault-addr annotation from ConfigMaps or Secrets without validation or allowlisting. When a value prefixed with vault: is present,...

CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...