https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:40:36.207622+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335220 EUVD-2026-335220 2026-10-06T18:40:36.254597+00:00 EUVD-2026-335220 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47828 fkie_cve-2026-47828 2026-10-06T18:40:36.254632+00:00

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.

 https://cve.radiocsirt.org/vuln/ghsa-93mr-7m4p-h3cq GHSA-93mr-7m4p-h3cq 2026-10-06T18:40:36.254668+00:00

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network attacker can terminate the TLS connection, harvest the Basic-auth credentials, and read the rendered-templates archive containing every bootstrap secret for the new BOSH Director, then replay the credentials against the real VM's agent for root code execution. Affected versions: bosh-cli versions prior to v7.10.4.