https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 18:33:40 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-bg37104 <p><strong>Affected:</strong> CleanStart: argo-cd, CleanStart: cert-manager-cmctl-fips</p> <p>ghsa-jxpm-75mh-9fp7 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-cd, CleanStart: cert-manager-cmctl-fips</p> <p>ghsa-jxpm-75mh-9fp7 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bg37104 https://cve.radiocsirt.org/vuln/cve-2026-50151 <p><strong>Affected:</strong> oras-project oras-go</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller&#39;s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.</p> <p><strong>Affected:</strong> oras-project oras-go</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller&#39;s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-50151