18717 matches found
AZL-87894 CVE-2026-39821 affecting package kubernetes for versions less than 1.30.10-25
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87663 CVE-2026-39821 affecting package docker-cli for versions less than 25.0.7-3
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87486 CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87798 CVE-2026-39821 affecting package golang for versions less than 1.26.4-3
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88059 CVE-2026-39821 affecting package moby-containerd-cc for versions less than 1.7.7-13
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-98583 CVE-2026-39821 affecting package golang 1.27.1-1
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87360 CVE-2026-39821 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87792 CVE-2026-39821 affecting package golang for versions less than 1.25.11-3
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87750 CVE-2026-27136 affecting package gh for versions less than 2.62.0-16
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87855 CVE-2026-42506 affecting package keda for versions less than 2.14.1-13
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88113 CVE-2026-27136 affecting package multus for versions less than 4.0.2-8
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87984 CVE-2026-39821 affecting package kured for versions less than 1.15.0-5
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88284 CVE-2026-39821 affecting package skopeo for versions less than 1.14.4-11
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88095 CVE-2026-39821 affecting package multus for versions less than 4.0.2-8
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87393 CVE-2026-39821 affecting package cert-manager for versions less than 1.12.15-9
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88104 CVE-2026-42506 affecting package multus for versions less than 4.0.2-8
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87834 CVE-2026-39821 affecting package jx for versions less than 3.10.182-4
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87212 CVE-2026-39821 affecting package cri-o 1.30.1-1
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87780 CVE-2026-42506 affecting package gh for versions less than 2.62.0-16
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87456 CVE-2026-42502 affecting package cf-cli for versions less than 8.7.11-7
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87573 CVE-2026-39821 affecting package cri-tools for versions less than 1.32.0-6
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-88239 CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87615 CVE-2026-27136 affecting package docker-buildx for versions less than 0.14.0-13
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87477 CVE-2026-42506 affecting package cf-cli for versions less than 8.7.11-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87372 CVE-2026-42502 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87873 CVE-2026-39821 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87891 CVE-2026-27136 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87471 CVE-2026-27136 affecting package cf-cli for versions less than 8.7.11-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87323 CVE-2026-42506 affecting package podman 5.6.1-10
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87927 CVE-2026-27136 affecting package kubernetes for versions less than 1.30.10-25
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87744 CVE-2026-42502 affecting package gh for versions less than 2.62.0-17
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87489 CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87822 CVE-2026-42506 affecting package influxdb for versions less than 2.7.5-17
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87152 CVE-2026-42506 affecting package azl-otel-collector 0.127.0-1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87588 CVE-2026-42502 affecting package cri-tools for versions less than 1.32.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87363 CVE-2026-42506 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87603 CVE-2026-27136 affecting package dasel for versions less than 2.8.1-4
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-88314 CVE-2026-39821 affecting package telegraf for versions less than 1.31.0-22
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-87317 CVE-2026-42502 affecting package podman 5.6.1-10
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87966 CVE-2026-25681 affecting package kubevirt for versions less than 1.7.1-7
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87513 CVE-2026-25680 affecting package cni-plugins for versions less than 1.4.0-6
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-87585 CVE-2026-25681 affecting package cri-tools for versions less than 1.32.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87858 CVE-2026-25680 affecting package keda for versions less than 2.14.1-14
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-87158 CVE-2026-25681 affecting package azl-otel-collector 0.127.0-1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87366 CVE-2026-25680 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-87498 CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-88245 CVE-2026-25681 affecting package prometheus-adapter for versions less than 0.12.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87414 CVE-2026-25680 affecting package cert-manager for versions less than 1.12.15-9
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-88338 CVE-2026-25681 affecting package telegraf for versions less than 1.31.0-23
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87882 CVE-2026-25681 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...