https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T17:41:50.863028+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-bg37104 CLEANSTART-2026-BG37104 — Security fix for ghsa-jxpm-75mh-9fp7 applied in: argo-cd 3.4.5-r1, cert-manager-cmctl-fips 2.5.0-r1 2026-10-12T17:41:50.869805+00:00

Affected: CleanStart: argo-cd, CleanStart: cert-manager-cmctl-fips

ghsa-jxpm-75mh-9fp7 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/cve-2026-50151 CVE-2026-50151 — oras-go: credential forwarding via unvalidated Location header in blob upload 2026-10-12T17:41:50.869856+00:00

Affected: oras-project oras-go

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.