18717 matches found
AZL-87714 CVE-2026-42506 affecting package docker-compose for versions less than 2.27.0-11
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88239 CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87582 CVE-2026-27136 affecting package cri-tools for versions less than 1.32.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87579 CVE-2026-42506 affecting package cri-tools for versions less than 1.32.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87939 CVE-2026-39821 affecting package kubevirt for versions less than 1.7.1-7
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87522 CVE-2026-39821 affecting package containerd2 for versions less than 2.2.4-2
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88341 CVE-2026-42502 affecting package telegraf for versions less than 1.31.0-23
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88290 CVE-2026-39821 affecting package sriov-network-device-plugin for versions less than 3.7.0-6
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87675 CVE-2026-39821 affecting package docker-compose for versions less than 2.27.0-11
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87363 CVE-2026-42506 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88227 CVE-2026-39821 affecting package prometheus-adapter for versions less than 0.12.0-6
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87290 CVE-2026-27136 affecting package podman 5.6.1-10
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87750 CVE-2026-27136 affecting package gh for versions less than 2.62.0-16
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87323 CVE-2026-42506 affecting package podman 5.6.1-10
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88374 CVE-2026-39821 affecting package vitess for versions less than 19.0.4-10
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87456 CVE-2026-42502 affecting package cf-cli for versions less than 8.7.11-7
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88170 CVE-2026-27136 affecting package packer for versions less than 1.9.5-15
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87146 CVE-2026-39821 affecting package azl-otel-collector 0.127.0-1
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87155 CVE-2026-27136 affecting package azl-otel-collector 0.127.0-1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87471 CVE-2026-27136 affecting package cf-cli for versions less than 8.7.11-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88302 CVE-2026-42506 affecting package sriov-network-device-plugin for versions less than 3.7.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87477 CVE-2026-42506 affecting package cf-cli for versions less than 8.7.11-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87272 CVE-2026-39821 affecting package podman 5.6.1-10
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87885 CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87393 CVE-2026-39821 affecting package cert-manager for versions less than 1.12.15-9
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87564 CVE-2026-39821 affecting package coredns for versions less than 1.11.4-17
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87432 CVE-2026-42506 affecting package cert-manager for versions less than 1.12.15-9
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87753 CVE-2026-39821 affecting package gh for versions less than 2.62.0-16
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88068 CVE-2026-39821 affecting package moby-engine for versions less than 25.0.3-18
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88236 CVE-2026-27136 affecting package prometheus-adapter for versions less than 0.12.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88113 CVE-2026-27136 affecting package multus for versions less than 4.0.2-8
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87816 CVE-2026-39821 affecting package influxdb for versions less than 2.7.5-17
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87822 CVE-2026-42506 affecting package influxdb for versions less than 2.7.5-17
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87915 CVE-2026-42506 affecting package kubernetes for versions less than 1.30.10-25
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87924 CVE-2026-42502 affecting package kubernetes for versions less than 1.30.10-25
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87663 CVE-2026-39821 affecting package docker-cli for versions less than 25.0.7-3
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87984 CVE-2026-39821 affecting package kured for versions less than 1.15.0-5
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88323 CVE-2026-27136 affecting package telegraf for versions less than 1.31.0-22
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87384 CVE-2026-39821 affecting package azcopy for versions less than 10.25.1-6
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87480 CVE-2026-25681 affecting package cf-cli for versions less than 8.7.11-7
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87591 CVE-2026-25680 affecting package dasel for versions less than 2.8.1-4
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-87366 CVE-2026-25680 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-87158 CVE-2026-25681 affecting package azl-otel-collector 0.127.0-1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87858 CVE-2026-25680 affecting package keda for versions less than 2.14.1-14
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-87612 CVE-2026-25681 affecting package docker-buildx for versions less than 0.14.0-15
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88338 CVE-2026-25681 affecting package telegraf for versions less than 1.31.0-23
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87690 CVE-2026-25681 affecting package docker-compose for versions less than 2.27.0-12
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87585 CVE-2026-25681 affecting package cri-tools for versions less than 1.32.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...