PT-2026-72963

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix pending command UAF in EIR updates MGMT OP SET LOCAL NAME is handled asynchronously on powered controllers and can run set name sync. When the controller is BR/EDR capable, set name sync updates the local nam...

PT-2026-72440

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft set pipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nft pipapo match can enter a bad state: - some fields can have their lookup tables resized while others did not - bit...

PT-2026-72961

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix advertising data UAFs hci find adv instance returns an adv info pointer that is valid only while hdev-lock is held. The advertising command-sync paths perform instance lookups without that lock and, in so...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: ocm-cli-fips, kube-mgmt, kubescape-operator, helm-set-status, maru, consul-k8s, tigera-operator, trivy-fips, falcoctl, rancher, chartmuseum, gitlab-operator, kgateway-fips, trivy-operator-fips, trivy, vcluster, kots, rancher-agent, drone, gitlab-operator-fips,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: kots, nova, flux-helm-controller, envoy-gateway, helm-push, helm-docs, chart-testing, chartmuseum, cerbos, k9s, cilium-cli, helm-mapkubeapis, k8sgpt, kubescape, zot, cert-manager-cmctl, linkerd2, kargo, trivy, flux, pluto, eksctl, headlamp, rancher-fleet, istio,...

GO-2026-5338 vulnerabilities

Vulnerabilities for packages: kots, envoy-gateway, helm-push, neuvector-scanner, tw, rancher-helm, gatekeeper, chartmuseum, steampipe, k9s, kubescape-operator, ctop, helm-mapkubeapis, k8sgpt, teleport, kubescape, manifest-tool, helm, zot, buildkitd, datadog-agent, xeol, rancher-agent, consul-k8s,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: kots, flux-helm-controller, envoy-gateway, helm-push, neuvector-scanner, tw, melange, rancher-helm, trivy-operator, chartmuseum, steampipe, k9s, cilium-cli, kubescape-operator, ctop, helm-mapkubeapis, k8sgpt, falco-no-driver, kubescape, manifest-tool, helm, zot,...

GO-2026-5475 vulnerabilities

Vulnerabilities for packages: kots, envoy-gateway, helm-push, neuvector-scanner, tw, rancher-helm, gatekeeper, chartmuseum, steampipe, k9s, kubescape-operator, ctop, helm-mapkubeapis, k8sgpt, teleport, kubescape, manifest-tool, helm, zot, buildkitd, datadog-agent, xeol, rancher-agent, consul-k8s,...

GO-2026-5879 vulnerabilities

Vulnerabilities for packages: kots, ratify, helm-push, tw, argo-cd, gatekeeper, rancher-helm, chartmuseum, steampipe, k9s, vcluster, cilium-cli, kubescape-operator, teleport, helm-mapkubeapis, kubescape, argocd-image-updater, kyverno, xeol, cert-manager-cmctl, conftest, rancher-agent, consul-k8s,...

GO-2026-5884 vulnerabilities

Vulnerabilities for packages: kots, ratify, helm-push, tw, argo-cd, gatekeeper, rancher-helm, chartmuseum, steampipe, k9s, vcluster, cilium-cli, kubescape-operator, teleport, helm-mapkubeapis, kubescape, argocd-image-updater, kyverno, xeol, cert-manager-cmctl, conftest, rancher-agent, consul-k8s,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, thanos-operator, bom, aws-flb-cloudwatch, mc, redka, opensearch-k8s-operator, minio, rancher-helm, src, steampipe, kubo, cilium-cli, timoni, falco-no-driver, spire-server, telegraf, mattermost, newrelic-fluent-bit-output, croc,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: thanos-operator, bom, ip-masq-agent, nri-f5, kind, emissary, nri-apache, spire-controller-manager, kubernetes-dashboard, aws-otel-collector, oauth2-proxy, migrate, kubernetes-csi-driver-hostpath, kubernetes-dashboard-api, aws-application-networking-k8s, eksctl,...

CVE-2026-73562

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...

CVE-2026-73562

CVE-2026-73562 describes a prototype-pollution vulnerability in Mongoose (MongoDB object modeling tool) via update casting that can occur when a user-controlled update uses a proto -prefixed dotted path under $set. Prior to versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2, schema logic can treat inher...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

SUSE CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...

EUVD-2026-57310

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-18652

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...

CVE-2026-18652

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...

CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...