https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:47:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-363371 EUVD-2026-363371 https://cve.radiocsirt.org/vuln/euvd-2026-363371 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66788 <p>A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.</p> <p>A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-66788 https://cve.radiocsirt.org/vuln/ghsa-264j-8377-4hmm <p>A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.</p> <p>A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.</p> https://cve.radiocsirt.org/vuln/ghsa-264j-8377-4hmm https://cve.radiocsirt.org/vuln/rhsa-2026:63016 <p>golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/coredns/coredns: CoreDNS: Denial of Service via crafted UDP datagram with proxyproto plugin submariner-operator: Broker ServiceAccount Secret (token + CA) logged in full at TRACE verbosity submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication submariner-operator: Operator ClusterRole grants cluster-wide create/update on all ConfigMaps submariner-operator: Release workflow consumes same-org composite action via mutable @devel branch ref submariner: IPsec PSK secrets file created with default world-readable permissions submariner: submariner: ipsec.conf stanza injection via remote-supplied CableName and Subnets lighthouse: Go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082 lighthouse: Dockerfile build stages use end-of-life Fedora 40 referenced by mutable tag</p> <p>golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/coredns/coredns: CoreDNS: Denial of Service via crafted UDP datagram with proxyproto plugin submariner-operator: Broker ServiceAccount Secret (token + CA) logged in full at TRACE verbosity submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication submariner-operator: Operator ClusterRole grants cluster-wide create/update on all ConfigMaps submariner-operator: Release workflow consumes same-org composite action via mutable @devel branch ref submariner: IPsec PSK secrets file created with default world-readable permissions submariner: submariner: ipsec.conf stanza injection via remote-supplied CableName and Subnets lighthouse: Go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082 lighthouse: Dockerfile build stages use end-of-life Fedora 40 referenced by mutable tag</p> https://cve.radiocsirt.org/vuln/rhsa-2026:63016