Most recent entries from all

Withdrawn: CLEANSTART-2026-HA46232 — Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

2026-09-30T16:59:33.250427+00:00

Withdrawn by the publisher.

Affected: CleanStart: metallb

Multiple security vulnerabilities affect the metallb package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details.

fkie_cve-2026-14362

2026-09-30T16:59:33.250739+00:00

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

GHSA-6r3r-6rpf-v429

2026-09-30T16:59:33.250814+00:00

RHSA-2026:54427 — Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.5 security update

2026-09-30T16:59:33.250850+00:00

github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation postcss: PostCSS: Information disclosure and denial of service via crafted CSS input console: Stored DOM XSS via unescaped pod logs in document.write