PT-2026-60668

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant has SecurityPolicy + TCPRoute RBAC baseline - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted the trigger - No admission...

PT-2026-60691

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description A nil-dereference occurs when a SecurityPolicy targets a TCPRoute that lacks the spec.authorization field. A namespace-scoped tenant can cause the gatewayapi runner to panic during ever...

Malicious code in qontract-reconcile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bee34269c7f3aae4181b856b9b73a57abf59acc94d076d51b4fb6c14b8fc5508 This release of qontract-reconcile uses uv's tool.uv.dependency-metadata mechanism in pyproject.toml to override the pagerduty package's declared...

MAL-2026-4765 Malicious code in qontract-reconcile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bee34269c7f3aae4181b856b9b73a57abf59acc94d076d51b4fb6c14b8fc5508 This release of qontract-reconcile uses uv's tool.uv.dependency-metadata mechanism in pyproject.toml to override the pagerduty package's declared...

EUVD-2025-23648

Malicious code in bioql PyPI...

CVE-2025-51857

The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks...

CVE-2025-51857: Improper Neutralization of Input During Web Page Generation

The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks...

CVE-2025-51857

The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due interaction between unexpected parameter values set for ClusterDeployment.hive.openshift.io/v1 and ClusterSync.hiveinternal.openshift.io/v1alpha1 objects in the Reconcile method i...

In execute() the amount routers pay is what user signed, but in _reconcile() the amount routers get is what nomad sends and this two amount are not necessary equal because of slippage in original domain

Lines of code Vulnerability details Impact routers pay for transaction in destination domain then nomad messages come and routers get paid again. but the amount routers pay in execute are what transaction sender signed and the amount routers receive is what nomad sends and handles in reconcile bu...

argo:fuzz_sensor_controller_reconcile: Null-dereference READ with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4871365397708800 Project: argo Fuzzing Engine: libFuzzer Fuzz Target: fuzzsensorcontrollerreconcile Job Type: libfuzzerasanargo Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL Sanitizer: addres...

Front Accounting 2.3RC2 - Multiple SQL Injections

Front Accounting 2.3RC2 - Multiple SQL Injections Advisory Name: Multiple SQL Injections in Front Accounting Internal Cybsec Advisory Id: 2010-1003-Multiple SQL Injections in Front Accounting Vulnerability Class: SQL Injection Affected Applications: Front Accounting v2.3RC2; other versions may al...

Front Accounting 2.3RC2 - Multiple SQL Injections

Advisory Name: Multiple SQL Injections in Front Accounting Internal Cybsec Advisory Id: 2010-1003-Multiple SQL Injections in Front Accounting Vulnerability Class: SQL Injection Affected Applications: Front Accounting v2.3RC2; other versions may also be affected. Affected Platforms: Any running...