https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:28:24.008952+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-364191 EUVD-2026-364191 2026-10-02T12:28:24.228771+00:00 EUVD-2026-364191 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72508 fkie_cve-2026-72508 2026-10-02T12:28:24.228821+00:00

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.

 https://cve.radiocsirt.org/vuln/ghsa-hr6f-38vx-3c48 GHSA-hr6f-38vx-3c48 2026-10-02T12:28:24.228857+00:00

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.

 https://cve.radiocsirt.org/vuln/rhsa-2026:60386 RHSA-2026:60386 — Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update 2026-10-02T12:28:24.228875+00:00

multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped ClusterRoleBinding and become cluster-admin via Application Subscription fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling volsync-addon-controller: volsync-addon-controller: annotation values rendered into YAML via text/template without escaping allows YAML injection into Subscription golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries grafana: Grafana: Privilege escalation via dashboard overwrite github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Intege…