https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:24:13.466044+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-364201 EUVD-2026-364201 2026-10-03T06:24:13.764605+00:00 EUVD-2026-364201 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73834 fkie_cve-2026-73834 2026-10-03T06:24:13.764668+00:00

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.

 https://cve.radiocsirt.org/vuln/ghsa-8m45-79jm-xw59 GHSA-8m45-79jm-xw59 2026-10-03T06:24:13.764707+00:00

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.

 https://cve.radiocsirt.org/vuln/rhsa-2026:60386 RHSA-2026:60386 — Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update 2026-10-03T06:24:13.764726+00:00

multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped ClusterRoleBinding and become cluster-admin via Application Subscription fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling volsync-addon-controller: volsync-addon-controller: annotation values rendered into YAML via text/template without escaping allows YAML injection into Subscription golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries grafana: Grafana: Privilege escalation via dashboard overwrite github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Intege…