https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:14:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-359628 EUVD-2026-359628 https://cve.radiocsirt.org/vuln/euvd-2026-359628 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71467 <p>A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.</p> <p>A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71467 https://cve.radiocsirt.org/vuln/ghsa-8x2m-938h-j94g <p>A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.</p> <p>A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.</p> https://cve.radiocsirt.org/vuln/ghsa-8x2m-938h-j94g https://cve.radiocsirt.org/vuln/rhsa-2026:60386 <p>multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped ClusterRoleBinding and become cluster-admin via Application Subscription fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling volsync-addon-controller: volsync-addon-controller: annotation values rendered into YAML via text/template without escaping allows YAML injection into Subscription golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries grafana: Grafana: Privilege escalation via dashboard overwrite github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Intege…</p> <p>multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped ClusterRoleBinding and become cluster-admin via Application Subscription fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling volsync-addon-controller: volsync-addon-controller: annotation values rendered into YAML via text/template without escaping allows YAML injection into Subscription golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries grafana: Grafana: Privilege escalation via dashboard overwrite github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Intege…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:60386