CVE-2026-48910

creationtimestamp| type| source ---|---|--- 2026-07-30 14:37:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/dsqsb44f2t5bl...

CVE-2026-16971

creationtimestamp| type| source ---|---|--- 2026-07-30 14:13:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/f23y4hauoujpy...

CVE-2026-18362

creationtimestamp| type| source ---|---|--- 2026-07-30 14:13:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/f23y4hauoujpy...

EUVD-2026-51138

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

CVE-2026-18361

creationtimestamp| type| source ---|---|--- 2026-07-30 14:07:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/blcb3neggfspp...

CVE-2026-18360

creationtimestamp| type| source ---|---|--- 2026-07-30 14:07:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/blcb3neggfspp...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-17544

creationtimestamp| type| source ---|---|--- 2026-07-30 12:17:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2ojh2ibweiexi 2026-07-31 12:40:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrwxyq3z2x23 2026-07-31 23:06:04+00:00| seen|...

CVE-2026-18382 Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...

CVE-2026-18378

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18378 Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

EUVD-2026-51094

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18378

The CVE-2026-18378 issue affects the koku-metrics-operator. A vulnerability exists in the CostManagementMetricsConfig custom resource, which allows a user to edit the CR to set an arbitrary upload URL. When authentication.type is token (default), the cluster-global Red Hat Cloud pull-secret beare...

EUVD-2026-51093

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-22620

creationtimestamp| type| source ---|---|--- 2026-07-30 11:52:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/d557ukhddnxri 2026-07-30 14:30:38+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrunp7jxzj2o...

CVE-2026-44615

creationtimestamp| type| source ---|---|--- 2026-07-30 11:29:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/boip2imn6yi5k...

CVE-2026-16969

creationtimestamp| type| source ---|---|--- 2026-07-30 11:19:57+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrud2b6bws2m 2026-07-30 14:07:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/blcb3neggfspp...

GHSA-WCHH-9X6H-7F6P

creationtimestamp| type| source ---|---|--- 2026-07-30 08:32:07+00:00| seen| https://gist.github.com/alon710/d12f2b2b8a8eb557d027885a6580665a...

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...