CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: azurefile-csi-fips, knative-operator-fips, atlantis, nats, ingress-nginx-controller-fips, gosu, slsa-verifier, omni-fips, kube-arangodb-fips, cloud-provider-azure-fips, sonobuoy-fips, telegraf, istio, gitness, kubescape, scorecard, amazon-ssm-agent-fips, harbor,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: azurefile-csi-fips, kiali-fips, aws-node-termination-handler, juicefs-csi-driver, aws-fsx-csi-driver-fips, knative-operator-fips, atlantis, crossplane-provider-aws-efs-fips, apache-exporter, step-fips, prometheus-pgbouncer-exporter-fips, ingress-nginx-controller-fips...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: azurefile-csi-fips, knative-operator-fips, atlantis, nats, ingress-nginx-controller-fips, gosu, slsa-verifier, omni-fips, kube-arangodb-fips, cloud-provider-azure-fips, sonobuoy-fips, telegraf, istio, gitness, kubescape, scorecard, amazon-ssm-agent-fips, harbor,...

CVE-2026-32280 vulnerabilities

Vulnerabilities for packages: git-lfs, azurefile-csi-fips, kiali-fips, aws-node-termination-handler, juicefs-csi-driver, aws-fsx-csi-driver-fips, knative-operator-fips, mockery, nri-apache, nri-f5, atlantis, kubewatch, crossplane-provider-aws-efs-fips, apache-exporter, govulncheck,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: git-lfs, azurefile-csi-fips, kiali-fips, aws-node-termination-handler, juicefs-csi-driver, aws-fsx-csi-driver-fips, knative-operator-fips, mockery, nri-apache, nri-f5, atlantis, kubewatch, crossplane-provider-aws-efs-fips, apache-exporter, govulncheck,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: git-lfs, azurefile-csi-fips, kiali-fips, aws-node-termination-handler, juicefs-csi-driver, aws-fsx-csi-driver-fips, knative-operator-fips, mockery, nri-apache, nri-f5, atlantis, kubewatch, crossplane-provider-aws-efs-fips, apache-exporter, govulncheck,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: aws-fsx-csi-driver-fips, crossplane-provider-aws-efs-fips, kubevirt-cdi-operator-fips, step-fips, opensearch-k8s-operator-fips, gitlab-cng, oauth2-proxy-fips, slsa-verifier, omni-fips, sonobuoy-fips, telegraf, gitness, consul-k8s, neuvector-dbgen, lvm-driver-fips,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: git-lfs, azurefile-csi-fips, kiali-fips, aws-node-termination-handler, juicefs-csi-driver, aws-fsx-csi-driver-fips, knative-operator-fips, mockery, nri-apache, nri-f5, atlantis, kubewatch, crossplane-provider-aws-efs-fips, apache-exporter, govulncheck,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: git-lfs, azurefile-csi-fips, kiali-fips, aws-node-termination-handler, juicefs-csi-driver, aws-fsx-csi-driver-fips, knative-operator-fips, mockery, nri-apache, nri-f5, atlantis, kubewatch, crossplane-provider-aws-efs-fips, apache-exporter, govulncheck,...

CVE-2026-39943

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records in directusrevisions whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline,...

CVE-2026-33781

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine pfe of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service DoS. On EX4k, and QFX5k platforms configur...

CVE-2026-33781 Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packets are received, memory leaks and eventually no traffic is passed

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine pfe of Juniper Networks Junos OS on specific EX and QFX Series devices allow an unauthenticated, adjacent attacker to cause a complete Denial of Service DoS. On EX4k, and QFX5k platforms configur...

CVE-2026-35461

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: net-kourier, trivy, opa, crossplane-provider-aws-elasticache, syft, crossplane-provider-azure-storage, spire-server, gitaly, kubeflow-pipelines, k3s, node-problem-detector, restic, weaviate, xeol, zot, kubernetes-csi-external-attacher, terragrunt, mcp-grafana,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: net-kourier, trivy, opa, crossplane-provider-aws-elasticache, syft, crossplane-provider-azure-storage, spire-server, gitaly, kubeflow-pipelines, k3s, node-problem-detector, restic, weaviate, xeol, zot, kubernetes-csi-external-attacher, terragrunt, mcp-grafana,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, helm-operator-fips, azurefile-csi-fips, kiali-fips, aws-node-termination-handler, aws-fsx-csi-driver-fips, crossplane-provider-aws-macie2, knative-operator-fips, crossplane-function-patch-and-transform, docker-fips,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, helm-operator-fips, azurefile-csi-fips, kiali-fips, aws-node-termination-handler, aws-fsx-csi-driver-fips, crossplane-provider-aws-macie2, knative-operator-fips, crossplane-function-patch-and-transform, docker-fips,...

Windows Telemetry Persistence

This is a Metasploit module that provides a persistence mechanism that installs a new telemetry provider for windows. If telemetry is turned on, when the scheduled task launches, it will execute the telemetry provider and execute our payload with system permissions...

PT-2026-31762

OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassi...

CVE-2026-39411 LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR ke...