https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:17:34.305598+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-363368 EUVD-2026-363368 2026-10-03T08:17:34.368418+00:00 EUVD-2026-363368 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66783 fkie_cve-2026-66783 2026-10-03T08:17:34.368457+00:00

A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

 https://cve.radiocsirt.org/vuln/ghsa-95w2-696m-24mq GHSA-95w2-696m-24mq 2026-10-03T08:17:34.368493+00:00

A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

 https://cve.radiocsirt.org/vuln/rhsa-2026:63016 RHSA-2026:63016 — Red Hat Security Advisory: Submariner v0.24 security fixes and container updates 2026-10-03T08:17:34.368512+00:00

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/coredns/coredns: CoreDNS: Denial of Service via crafted UDP datagram with proxyproto plugin submariner-operator: Broker ServiceAccount Secret (token + CA) logged in full at TRACE verbosity submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication submariner-operator: Operator ClusterRole grants cluster-wide create/update on all ConfigMaps submariner-operator: Release workflow consumes same-org composite action via mutable @devel branch ref submariner: IPsec PSK secrets file created with default world-readable permissions submariner: submariner: ipsec.conf stanza injection via remote-supplied CableName and Subnets lighthouse: Go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082 lighthouse: Dockerfile build stages use end-of-life Fedora 40 referenced by mutable tag