https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:20:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-372765 EUVD-2026-372765 https://cve.radiocsirt.org/vuln/euvd-2026-372765 https://cve.radiocsirt.org/vuln/fkie_cve-2026-89060 <p>A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.</p> <p>A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted namespace. If those resources reference Secrets, the add-on may copy the referenced Secrets to the attacker-controlled managed cluster.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-89060 https://cve.radiocsirt.org/vuln/ghsa-39w5-9x42-rwmr <p>A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.</p> <p>A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.</p> https://cve.radiocsirt.org/vuln/ghsa-39w5-9x42-rwmr https://cve.radiocsirt.org/vuln/rhsa-2026:67539 <p>database/sql: Postgres Scan Race Condition grafana: Grafana: Privilege escalation via dashboard overwrite github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations submariner-operator: Broker ServiceAccount Secret (token + CA) logged in full at TRACE verbosity github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution stolostron/multicluster-observability-addon: Cross-namespace Secret disclosure in multicluster-observability-addon via unvalidated configuration references</p> <p>database/sql: Postgres Scan Race Condition grafana: Grafana: Privilege escalation via dashboard overwrite github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations submariner-operator: Broker ServiceAccount Secret (token + CA) logged in full at TRACE verbosity github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution stolostron/multicluster-observability-addon: Cross-namespace Secret disclosure in multicluster-observability-addon via unvalidated configuration references</p> https://cve.radiocsirt.org/vuln/rhsa-2026:67539