Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

CVE-2026-49998

#### Summary Centrifugo's dynamic JWKS endpoint feature can verify a JWT for one allowed issuer using a public key cach

历史摘要 · 未重新核验 · GitHub Advisory

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

CVE-2026-49835

### Impact An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server. T

历史摘要 · 未重新核验 · GitHub Advisory

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

CVE-2026-49478

## Impact Three security vulnerabilities were identified in the OIDC Discovery client: 1. **Blind Server-Side Request

历史摘要 · 未重新核验 · GitHub Advisory

Probo has an open redirect bypass via path normalization

CVE-2026-49820

### Impact Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

CVE-2026-50566

### Summary A follow-up bypass of the round-4 PodSpec hardening (GHSA-gx55-f84r-v3r7, GHSA-wmgg-3p4h-48x7, GHSA-v455-mv

历史摘要 · 未重新核验 · GitHub Advisory

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

CVE-2026-50565

### Summary Fission builder pods were created with `ServiceAccountName: fission-builder` and no `AutomountServiceAccoun

历史摘要 · 未重新核验 · GitHub Advisory

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

CVE-2026-50564

### Summary Fission's `Environment` CRD exposes `spec.runtime.podSpec` and `spec.builder.podSpec`, which are merged int

历史摘要 · 未重新核验 · GitHub Advisory

Fission Container Executor Function PodSpec Injection Leading to Node Escape

CVE-2026-50563

### Summary Fission's Container Executor path lets a tenant supply `Function.spec.podspec` directly; the executor merge

历史摘要 · 未重新核验 · GitHub Advisory

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

CVE-2026-50545

### Summary A stronger framing of the same root cause as GHSA-gx55-f84r-v3r7: the `Environment.spec.runtime.podSpec` /

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

CVE-2026-49824

### Summary The Fission Function admission webhook (`pkg/webhook/function.go`) validated that `spec.secrets[].namespace

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

CVE-2026-49823

### Summary A Fission Function spec carries three reference types — Secret, ConfigMap, and Package. The first two were

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

CVE-2026-49822

### Summary A low-privilege developer who could create a `KubernetesWatchTrigger` (KWT) in their own namespace was able

历史摘要 · 未重新核验 · GitHub Advisory

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

CVE-2026-49821

### Summary Fission's `buildermgr` controller processed `Package` CRDs without verifying that `Package.spec.environment

历史摘要 · 未重新核验 · GitHub Advisory

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

### Summary The Fission MessageQueueTrigger (MQT) scaler controller exposed two privilege-escalation primitives to any

历史摘要 · 未重新核验 · GitHub Advisory

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

CVE-2026-44840

## Summary The `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

### Summary The `GET /api/v1/ddns` and `GET /api/v1/notification` endpoints return full resource objects including plai

历史摘要 · 未重新核验 · GitHub Advisory

Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)

CVE-2026-49338

## Summary In gonic, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per

历史摘要 · 未重新核验 · GitHub Advisory

gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists

CVE-2026-49339

## Summary The maintainer's recent fix in [`6dd71e6a3c966867ef8c900d359a7df75789f410`](https://github.com/sentriz/gonic

历史摘要 · 未重新核验 · GitHub Advisory

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

CVE-2026-49340

## Summary A logic error in `ServeCreateOrUpdatePlaylist` allows **any authenticated Subsonic user** (including non-adm

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

CVE-2026-53523

## 1. Description The `getRedirectURL` function in `oauth2.go:22-29` constructs the OAuth2 callback URL by concatenatin

历史摘要 · 未重新核验 · GitHub Advisory