https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T07:38:55.140774+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343517 EUVD-2026-343517 2026-10-15T07:38:55.203241+00:00 EUVD-2026-343517 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18378 fkie_cve-2026-18378 2026-10-15T07:38:55.203279+00:00

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.

 https://cve.radiocsirt.org/vuln/ghsa-8jfr-h5wv-8vhv GHSA-8jfr-h5wv-8vhv 2026-10-15T07:38:55.203313+00:00

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.

 https://cve.radiocsirt.org/vuln/rhsa-2026:81201 RHSA-2026:81201 — Red Hat Security Advisory: Cost Management Metrics Operator Update 2026-10-15T07:38:55.203332+00:00

glibc: glibc: Out-of-bounds write via TSIG record processing glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings glibc: glibc: Application crash or uninitialized memory read via crafted DNS response p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (SSRF / confused deputy) project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled Prometheus service_address project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url openssl: QUIC server may trigger double free when processing INITIAL packet acl: Symlink traversal privilege escalation via libacl functions attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values openssl: heap buffer overflow in CMS key unwrapping openssl: invalid pointer dereference in CMP server via crafted protectionAlg