Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

CVE-2026-48786

### Summary The target search endpoint (`POST /api/latest/fleet/targets`) returned team enroll secrets and full team co

历史摘要 · 未重新核验 · GitHub Advisory

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

CVE-2026-73080

### Impact `VolumeServer.FetchAndWriteNeedle` fetches a caller-supplied remote endpoint and writes the response into a n

历史摘要 · 未重新核验 · GitHub Advisory

go-git: Malicious reference names may modify files outside the reference storage

CVE-2026-71557

### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the reposito

历史摘要 · 未重新核验 · GitHub Advisory

go-git: Worktree operations may follow symlinks

CVE-2026-71556

## Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended wo

历史摘要 · 未重新核验 · GitHub Advisory

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

CVE-2026-54910

### Summary The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters:

历史摘要 · 未重新核验 · GitHub Advisory

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

CVE-2026-54908

### Impact Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. ### Patches

历史摘要 · 未重新核验 · GitHub Advisory

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

CVE-2026-54909

### Impact Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute ### Patches Upgrad

历史摘要 · 未重新核验 · GitHub Advisory

sigstore-go fails to check signature timestamps against a signing key's validity period

CVE-2026-54787

sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys

历史摘要 · 未重新核验 · GitHub Advisory

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

CVE-2026-53551

### Summary The free5GC AUSF (Authentication Server Function) does not validate the `supiOrSuci` field in UE authentica

历史摘要 · 未重新核验 · GitHub Advisory

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

CVE-2026-54725

## Summary The vault-secrets-webhook reads the `vault.security.banzaicloud.io/vault-addr` annotation from any ConfigMap

历史摘要 · 未重新核验 · GitHub Advisory

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

CVE-2026-65835

### Summary CVE-2026-22872 (GHSA-qjjm-7j9w-pw72) reported that a Tenant Owner could create cluster-scoped resources (e.g

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

CVE-2026-65834

### Summary `CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex` and `ForbiddenAnnotations.Regex` are never v

历史摘要 · 未重新核验 · GitHub Advisory

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

CVE-2026-52856

### Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.

历史摘要 · 未重新核验 · GitHub Advisory

Wings exposes node configuration secrets through egg configuration-file templating

CVE-2026-52855

### Impact **Type:** Exposure of sensitive information / insufficiently protected credentials leading to privilege esca

历史摘要 · 未重新核验 · GitHub Advisory

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

CVE-2026-52857

### Summary Config file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a g

历史摘要 · 未重新核验 · GitHub Advisory

netfoil: Incorrect block responses could lead to localhost traffic

### Summary `0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfo

历史摘要 · 未重新核验 · GitHub Advisory

Logging operator has Fluentd configuration injection that allows remote code execution

CVE-2026-54680

### Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly int

历史摘要 · 未重新核验 · GitHub Advisory

ZITADEL Users Can Self-Verify Email/Phone via API

CVE-2026-54693

### Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as veri

历史摘要 · 未重新核验 · GitHub Advisory

prebid-server's request forgery vulnerability allows for possible host environment data extraction

CVE-2026-54735

### Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Wit

历史摘要 · 未重新核验 · GitHub Advisory

goshs has ACL Bypass & Path Traversal

CVE-2026-66064

## Summary `sendFile` derives the served filename from the raw request path while opening the file from the cleaned pat

历史摘要 · 未重新核验 · GitHub Advisory