CVE-2026-18874 Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

CVE-2026-18874

In volsync-addon-controller, annotation values are rendered into YAML via Go's text/template without escaping, enabling YAML injection into the OLM Subscription resource. Exploitation requires high privileges and affects only clusters with the volsync-addon-deploy-type: olm annotation enabled. Re...

CVE-2026-18874 Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

CVE-2026-18874

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

CVE-2026-53451

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to...

CVE-2026-53451

Ground Station (a browser-based suite for satellite tracking, SDR reception, and telemetry decoding) prior to version 0.4.13 is vulnerable to unauthenticated remote code execution via a path traversal in the save-waterfall-snapshot Socket.IO command. The snapshotName parameter is passed to os.pat...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.53 security and extras update

Red Hat OpenShift Container Platform release 4.18.53 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.43 security and extras update

Red Hat OpenShift Container Platform release 4.19.43 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

PT-2026-78558

Name of the Vulnerable Software and Affected Versions volsync-addon-controller affected versions not specified Description A flaw exists that allows the injection of malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This occurs because...

PT-2026-78442

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.4.13 Description An unauthenticated Socket.IO command save-waterfall-snapshot allows an attacker to control the snapshotName input. This input is processed by backend/handlers/entities/sdr.py and passed to...

MONAI vulnerable to OS command injection

Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11. It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email. Summary MONAI...

ROOT-APP-NPM-CVE-2026-53550 CVE-2026-53550 in js-yaml - Patched by Root

Root has patched CVE-2026-53550 in the js-yaml package for Root:npm. Multiple fixed versions available...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.29 security and extras update

Red Hat OpenShift Container Platform release 4.21.29 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.34 security and extras update

Red Hat OpenShift Container Platform release 4.20.34 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.10 security and extras update

Red Hat OpenShift Container Platform release 4.22.10 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

ANT-2026-DVZKVAV1 · Suricata · Use-After-Free

use-after-free medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-DVZKVAV1: Heap use-after-free write in YAML...

CVE-2021-30145

creationtimestamp| type| source ---|---|--- 2026-08-16 19:00:06+00:00| seen| Telegram/XOWZ03GAQaPFK4QUsQrA4nOgtkuM--UdLdqLjOtVYCBWw 2026-08-17 00:00:09+00:00| published-proof-of-concept| Telegram/XOWZ03GAQaPFK4QUsQrA4nOgtkuM--UdLdqLjOtVYCBWw...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

CVE-2022-1471 — SnakeYAML RCE lab Jira / Automation for Jira...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: crossplane, local-path-provisioner, nri-nginx, terraform-provider-acme, stern, cert-manager-istio-csr, nri-consul, conftest, pluto, trufflehog, grafana-alloy, nri-rabbitmq, octo-sts, chisel, aws-load-balancer-controller, sonobuoy, k8ssandra-client, kube-rbac-proxy,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: crossplane, local-path-provisioner, nri-nginx, terraform-provider-acme, stern, cert-manager-istio-csr, nri-consul, conftest, pluto, trufflehog, grafana-alloy, nri-rabbitmq, octo-sts, chisel, aws-load-balancer-controller, sonobuoy, k8ssandra-client, kube-rbac-proxy,...