CVE-2026-40293

OpenFGA OpenID/OpenFGA Playground vulnerability (CVE-2026-40293) affects OpenFGA 0.1.4–1.13.1 when preshared authentication is used and the built‑in playground is enabled with the endpoint accessible beyond localhost. The local HTML response from /playground reveals the preshared API key, enablin...

Allocation of Resources Without Limits or Throttling

Overview github.com/coredns/coredns/core/dnsserver is a package that implements all the interfaces from Caddy, so that CoreDNS can be a servertype plugin. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of resource-limiting...

PT-2026-1913

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.0 Description CoreDNS is a DNS server that utilizes plugins. Several CoreDNS server implementations, including gRPC, HTTPS, and HTTP/3, do not have sufficient resource limits. An unauthenticated remote attacker c...

Incorrect Default Permissions

Overview bzfs is a bzfs is a reliable near real-time, parallel replication and backup command-line tool for ZFS. It replicates snapshots from many local or remote source ZFS datasets and their descendants to local or remote destination datasets, using zfs send/receive and ssh, and can operate at...

Server-side Request Forgery (SSRF)

Overview @portkey-ai/gateway is an A fast AI gateway by Portkey Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the x-portkey-custom-host request header, which allows user-supplied values to determine the destination baseURL in the proxy route. An attacker...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Service Call functionality. A user with sufficient privileges to create Kyverno policies can expose all data from a Kubernetes cluster using a malicious Kyverno policy that makes external service cal...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Service Call functionality. A user with sufficient privileges to create Kyverno policies can expose all data from a Kubernetes cluster using a malicious Kyverno policy that makes external service cal...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the matchSignatures function in cosign.go, which does not check for subjectRegExp or issuerRegExp values during artifact signature verification. An attacker can deploy unauthorized...