61671 matches found
CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...
CVE-2026-40564
Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...
EUVD-2026-31846
Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...
CVE-2026-40564 Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...
MAL-2026-4782 Malicious code in @catclaw/message-logger-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf070f85ba454a799d80e6998ee717f0fc9084513041893a164752162e0b0864 On plugin registration, the log-collector is enabled by default and uploads session JSONL files from /.openclaw/agents//sessions to...
SUSE CVE-2026-9277
shell-quote's quote function did not validate object-token inputs against the operator model used by parse. The .op field was backslash-escaped character by character using /./g, which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in .op therefore passed...
GHSA-C32J-VQHX-RX3X vulnerabilities
Vulnerabilities for packages: kube-logging-operator, kube-fluentd-operator, cinc-auditor...
CVE-2026-45363 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, kube-fluentd-operator, cinc-auditor...
GHSA-C32J-VQHX-RX3X vulnerabilities
Vulnerabilities for packages: kube-fluentd-operator, logstash, gitlab-rails-ce, kube-logging-operator, cinc-auditor, gitlab-rails-ce-fips...
CVE-2026-45363 vulnerabilities
Vulnerabilities for packages: kube-fluentd-operator, logstash, gitlab-rails-ce, kube-logging-operator, cinc-auditor, gitlab-rails-ce-fips...
PT-2026-43265
Name of the Vulnerable Software and Affected Versions Apache Flink Kubernetes Operator versions 1.3.0 through 1.14.x Description A Server-Side Request Forgery SSRF and local file access issue exists where the jarURI in FlinkSessionJob is not validated. This allows a user with CR create permission...
Apache Flink Kubernetes Operator 安全漏洞
Apache Flink Kubernetes Operator is an operations component for Flink clusters developed by the Apache Foundation. Versions of Apache Flink Kubernetes Operator from 1.3.0 to 1.15.0 contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of the jarURI in...
ZTE ZXUniPOS NDS-LTE 安全漏洞
ZTE ZXUniPOS NDS-LTE is an operator network positioning platform developed by ZTE Corporation. ZTE ZXUniPOS NDS-LTE has a security vulnerability, which stems from business logic defects. Attackers can exploit the features of legitimate applications in an unintended and abnormal manner to carry ou...
CVE-2026-40564: Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties, Server-Side Request Forgery SSRF vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files...
GHSA-FQW6-GF59-QR4W vulnerabilities
Vulnerabilities for packages: kaniko, buildkitd, kargo, manifest-tool, docker-compose, rancher-agent, headlamp, syft, zarf, neuvector-scanner, docker-cli-buildx, kubescape, opa, containerd, chartmuseum, helm-mapkubeapis, k8ssandra-client, linkerd2, newrelic-infrastructure-agent, helm-push,...
CVE-2026-46680 vulnerabilities
Vulnerabilities for packages: kaniko, buildkitd, kargo, manifest-tool, docker-compose, rancher-agent, headlamp, syft, zarf, neuvector-scanner, docker-cli-buildx, kubescape, opa, containerd, chartmuseum, helm-mapkubeapis, k8ssandra-client, linkerd2, newrelic-infrastructure-agent, helm-push,...
CVE-2026-46680 vulnerabilities
Vulnerabilities for packages: containerd, falco-no-driver, docker-compose-fips, eksctl, jfrog-cli, opa, kube-arangodb, tigera-operator-fips, k8ssandra-client, grype, steampipe, cg, gogatekeeper, upwind-agent, kubescape, syft, docker-cli-buildx, k9s-fips, gatekeeper, eks-node-monitoring-agent-fips...
CVE-2026-9277
shell-quote's quote function did not validate object-token inputs against the operator model used by parse. The .op field was backslash-escaped character by character using /./g, which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in .op therefore passed...
CVE-2026-9277 shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
shell-quote's quote function did not validate object-token inputs against the operator model used by parse. The .op field was backslash-escaped character by character using /./g, which in JavaScript does not match line terminators \n, \r, U+2028, U+2029. A line terminator in .op therefore passed...
PT-2026-42766
Name of the Vulnerable Software and Affected Versions shell-quote versions prior to 1.8.4 Description The quote function fails to validate object-token inputs against the operator model used by parse. Specifically, the .op field is escaped using a regular expression that does not match line...