EUVD-2026-87677

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...

CVE-2026-100704

The Kyverno policy engine for Kubernetes (versions 1.14.0 through 1.19.0 ) contains a vulnerability in the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator. The evaluator fails to read the spec.images and spec.allowedValues fields of a PolicyException . Consequently, if a PolicyExcep...

PT-2026-99375

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.14.0 through 1.19.0 Description The ImageValidatingPolicy evaluator fails to process the spec.images and spec.allowedValues fields within a PolicyException. When a PolicyException matches a resource via policyRefs and...

CVE-2026-93643

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...

EUVD-2026-87101

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

Versions of MinIO through 7aac2a2 and pgsty/silo before 1233254 are vulnerable to a security flaw where the system fails to verify if all received x-amz-* headers are present in the client-supplied X-Amz-SignedHeaders list. Specifically, the extractSignedHeaders() function in cmd/signature-v4-uti...

EUVD-2026-86510

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

PT-2026-98865

Name of the Vulnerable Software and Affected Versions OnlyOffice/Document Editing affected versions not specified Description An unauthenticated remote attacker with access to a supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes. This allows the...

Linux Distros Unpatched Vulnerability : CVE-2026-57178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without...

PT-2026-98655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vdpasim blk check range function where it logs an invalid start sector but continues validating the request. This leads to an unsigned capacity subtraction...

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

GHSA-3C93-F73F-QC9H social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such a...

CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

DEBIAN-CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178

The Python Social Auth library, specifically the vk-app backend , is vulnerable to an authentication bypass in versions prior to 5.0.0 . The root cause is that the backend accepts VK application callback data without verifying the signature when the auth_key parameter is missing. This allows an a...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

EUVD-2026-86312

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

CVE-2026-57178 social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...