CVE-2026-71475 Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...

CVE-2026-71475

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...

PT-2026-70870

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where a compromised managed cluster, known as a spoke, can inject unencoded data into the Insights API URL path. This happens because the ClusterID variable, which is...

CVE-2026-66808

A flaw was found in hypershift-addon-operator. A hub-cluster administrator with write access to the hypershift-operator-install-flags ConfigMap can inject malicious command-line arguments into the privileged install Job. This vulnerability, known as argument injection, allows the attacker to pull...

randstad-linux-azure-architect-poc

Randstad Azure Linux Architect — POC GitHub: https://gith...

EUVD-2012-3837

Malware in sbrugna...

Malicious code in test-mlw2-spoke-riled-vells-liths (npm)

The package test-mlw2-spoke-riled-vells-liths was found to contain malicious code...

Malicious code in test-mlw2-nohow-spoke (npm)

The package test-mlw2-nohow-spoke was found to contain malicious code...

MAL-2025-35876 Malicious code in test-mlw2-nohow-spoke (npm)

The package test-mlw2-nohow-spoke was found to contain malicious code...

MAL-2025-36311 Malicious code in test-mlw2-spoke-riled-vells-liths (npm)

The package test-mlw2-spoke-riled-vells-liths was found to contain malicious code...

Zero Trust—Part 1: Networking

Enterprises used to be able to secure their corporate perimeters with traditional network controls and feel confident that they were keeping hackers out. However, in a mobile- and cloud-first world, in which the rate and the sophistication level of security attacks are increasing, they can no...

Code injection

The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service spoke crash via spoke-to-spoke traffic, aka Bug ID CSCtz02622...

CVE-2012-3893

The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service spoke crash via spoke-to-spoke traffic, aka Bug ID CSCtz02622...

CVE-2012-3915

The DMVPN tunnel implementation in Cisco IOS 15.2 allows remote attackers to cause a denial of service persistent IKE state via a large volume of hub-to-spoke traffic, aka Bug ID CSCtq39602...

PT-2012-5065

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.2 through 15.3 Description The issue allows remote authenticated users to cause a denial of service, resulting in a spoke crash, via spoke-to-spoke traffic. Recommendations For Cisco IOS versions 15.2 through 15.3, consid...

CVE-2012-3893: Undefined Security Weakness

The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service spoke crash via spoke-to-spoke traffic, aka Bug ID CSCtz02622...

CVE-2012-3915: Improper Restriction of Operations within the Bounds of a Memory Buffer

The DMVPN tunnel implementation in Cisco IOS 15.2 allows remote attackers to cause a denial of service persistent IKE state via a large volume of hub-to-spoke traffic, aka Bug ID CSCtq39602...