{"vulnerability": "cve-2026-5452", "sightings": [{"uuid": "2bbf786c-a635-4146-a4e6-2462a08cef55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5452", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miktizeafs2n", "content": "", "creation_timestamp": "2026-04-03T04:01:09.871796Z"}, {"uuid": "d8f3ad42-6626-47d5-8e92-cd6f6990bcd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54522", "type": "seen", "source": "https://gist.github.com/alon710/f9483ca84f65ab9c98c78744c876def1", "content": "# CVE-2026-54522: CVE-2026-54522: Same-Process Use-After-Free and Cross-Buffer Data Disclosure in msgpack-ruby\n\n> **CVSS Score:** 2.1\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54522\n\n## Summary\nA Use-After-Free (UAF) vulnerability exists in msgpack-ruby prior to version 1.8.2. The MessagePack::Buffer#clear method returns the associated 4 KiB rmem page to the shared pool but fails to reset the buffer's tracking pointers (rmem_last, rmem_end, and rmem_owner). Subsequent write operations on the cleared buffer can alias the freed page, allowing concurrent buffers to access, disclose, or corrupt cross-buffer data. This issue is resolved in version 1.8.2.\n\n## TL;DR\nA Use-After-Free in msgpack-ruby < 1.8.2 allows cross-buffer memory aliasing, resulting in same-process information disclosure and stream corruption when buffers are cleared and reused.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416 (Use After Free)\n- **Attack Vector**: Local (AV:L)\n- **CVSS v4.0 Score**: 2.1 (Low)\n- **Exploit Status**: Proof-of-Concept Available\n- **Impact**: Information Disclosure / Stream Corruption\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ruby applications utilizing the msgpack-ruby gem with persistent or pooled MessagePack::Buffer instances.\n- **msgpack-ruby**: < 1.8.2 (Fixed in: `1.8.2`)\n\n## Mitigation\n\n- Upgrade the msgpack dependency to version 1.8.2 or later.\n- Refactor applications to instantiate a new MessagePack::Buffer for every serialization task instead of reusing and clearing a persistent buffer.\n- Conduct static analysis scanning of dependency trees to identify and flag older versions of the msgpack gem.\n\n**Remediation Steps:**\n1. Open the application's Gemfile and locate the msgpack dependency declaration.\n2. Update the entry to require version 1.8.2 or higher: gem 'msgpack', '>= 1.8.2'\n3. Execute the package manager command to update the dependency: bundle update msgpack\n4. Deploy the updated dependency configuration to testing and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-4mrv-5p47-p938](https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938)\n- [Fix Commit 5627d71606b565641d2dd501b82aae862f4abe90](https://github.com/msgpack/msgpack-ruby/commit/5627d71606b565641d2dd501b82aae862f4abe90)\n- [Ruby Advisory Database Entry](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/msgpack/CVE-2026-54522.yml)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54522) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T17:31:24.215031Z"}, {"uuid": "5c946aa5-3214-4fbe-b2f5-ec10a36ee606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54522", "type": "published-proof-of-concept", "source": "https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938", "content": "", "creation_timestamp": "2026-07-30T18:35:03.754749Z"}, {"uuid": "4010b715-f46c-41d4-97e0-3bb58a49aa4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54527", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms23gwvzea2r", "content": "[26.05] python3Packages.jupyterlab-git: fix CVE-2026-54527 and CVE-2026-54528\n\nhttps://github.com/NixOS/nixpkgs/pull/547982\n\n#security", "creation_timestamp": "2026-08-01T18:19:51.086582Z"}, {"uuid": "fac59819-ad54-402b-849f-5bae822347f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54528", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms23gwvzea2r", "content": "[26.05] python3Packages.jupyterlab-git: fix CVE-2026-54527 and CVE-2026-54528\n\nhttps://github.com/NixOS/nixpkgs/pull/547982\n\n#security", "creation_timestamp": "2026-08-01T18:19:51.154667Z"}, {"uuid": "3b67ce85-684a-420f-8df4-3d89a1d644c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54528", "type": "published-proof-of-concept", "source": "https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-436q-jwfr-rm2h", "content": "", "creation_timestamp": "2026-06-18T07:12:50.000000Z"}, {"uuid": "1ed82d99-4939-479c-ab10-74557af23a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54527", "type": "published-proof-of-concept", "source": "https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5", "content": "", "creation_timestamp": "2026-06-18T07:12:58.000000Z"}, {"uuid": "05544ba6-0d5b-41e9-8b27-2b32c0500380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54527", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq64oaqtfb24", "content": "CVE-2026-54527 - jupyterlab-git\nThe JupyterLab Git extension allows attackers to create malicious file names that can execute code when viewed by others. This can lead to unauthorized access to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#jupyterlabgit #jupyterlab #pip #CVE #infosec", "creation_timestamp": "2026-07-08T22:02:05.569243Z"}, {"uuid": "4d4e0cce-0bee-4189-b8f1-a5cc594250e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-54527", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116887783224020082", "content": "CVE-2026-54527: CRITICAL XSS in jupyterlab-git (<0.54.0). Malicious Git filenames can execute JavaScript when viewed in the Git History tab \u2014 risking session hijack & data theft. Upgrade to 0.54.0+ ASAP. https://radar.offseq.com/threat/cve-2026-54527-cwe-79-improper-neutralization-of-i-859af0d357310c79 #OffSeq #XSS #jupyterlab #security", "creation_timestamp": "2026-07-09T03:00:29.149648Z"}, {"uuid": "c6bafa97-033b-468a-a3fa-0d822a286eb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-54527", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mq6ndtyssy2f", "content": "jupyterlab-git <0.54.0 is vulnerable to CRITICAL XSS (CVE-2026-54527). Malicious filenames can run code in users\u2019 browsers. Upgrade to 0.54.0+ now! \ud83d\udd12 https://radar.offseq.com/threat/cve-2026-54527-cwe-79-improper-neutralization-of-i-859af0d357310c79 #OffSeq #security #jupyterlab", "creation_timestamp": "2026-07-09T03:00:31.123766Z"}, {"uuid": "ce0d9272-2325-4415-b7c2-de9b7bcdda90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54527", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mq6u6q5sii2e", "content": "Daily IT Security Digest \u2014 2026-07-09\nnot yet patched. Security teams should audit their environments against these disclosed exploit chains.\nSource: https://infosec.exchange/@AAKL/116851105666469635\n\n## 4. CRITICAL XSS in jupyterlab-git (CVE-2026-54527)", "creation_timestamp": "2026-07-09T05:02:54.480939Z"}, {"uuid": "40815350-4326-4037-a199-9cbb703f29f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54526", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-48p8-g2fx-3wwm", "content": "", "creation_timestamp": "2026-08-13T16:35:09.648187Z"}, {"uuid": "1b70529a-62ec-4bc2-bdf2-115eaf7c7ee0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54526", "type": "seen", "source": "https://gist.github.com/alon710/ee760ed8dd4e3944f68b62f514473cdc", "content": "# CVE-2026-54526: CVE-2026-54526: Strict Template Referencing Bypass and Privilege Escalation in Argo Workflows\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-08-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54526\n\n## Summary\nA critical security bypass vulnerability in Argo Workflows allows authenticated attackers with workflow submission privileges to bypass 'Strict' or 'Secure' template referencing restrictions. By injecting unvalidated fields into the nested ArtifactGC configuration, attackers can execute arbitrary pod patches, leading to host namespace escape and cluster-wide privilege escalation.\n\n## TL;DR\nArgo Workflows fails to recursively validate the ArtifactGC structure during template override sanitization, enabling attackers to inject custom pod spec patches and service accounts to compromise worker nodes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284\n- **Attack Vector**: Network\n- **CVSS v3.1**: 9.9 (Critical)\n- **CVSS v4.0**: 8.9 (High)\n- **Exploit Maturity**: Proof-of-Concept / Technical Bypass\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- Argo Workflows\n- **Argo Workflows**: >= 3.7.0, < 3.7.15 (Fixed in: `v3.7.15`)\n- **Argo Workflows**: >= 4.0.0, < 4.0.6 (Fixed in: `v4.0.6`)\n\n## Mitigation\n\n- Upgrade to Argo Workflows v3.7.15, v4.0.6, or later versions.\n- Deploy Kyverno or OPA Gatekeeper policies to reject Workflow submissions with nested ServiceAccountName or PodSpecPatch in ArtifactGC.\n- Apply least-privilege RBAC to all workflow service accounts to minimize the blast radius of a potential compromise.\n\n**Remediation Steps:**\n1. Identify current deployed versions of Argo Workflows across all clusters.\n2. Apply the update to v3.7.15 (for 3.7.x) or v4.0.6 (for 4.0.x) using Helm or kubectl apply.\n3. Verify the installation by testing workflow submissions with custom podSpecPatch fields under ArtifactGC to ensure they are blocked.\n4. Monitor controller logs for any validation errors indicating rejected submissions containing unauthorized overrides.\n\n## References\n\n- [Official Fix Commit](https://github.com/argoproj/argo-workflows/commit/277e9cef0ad16d7eaaab253573d0695951a65dbd)\n- [Backported Fix Commit](https://github.com/argoproj/argo-workflows/commit/358cc3968c8f06f1be0967e41df191088db0b662)\n- [v3.7.15 Release Notes](https://github.com/argoproj/argo-workflows/releases/tag/v3.7.15)\n- [v4.0.6 Release Notes](https://github.com/argoproj/argo-workflows/releases/tag/v4.0.6)\n- [GitHub Advisory Portal (GHSA-48p8-g2fx-3wwm)](https://github.com/argoproj/argo-workflows/security/advisories/GHSA-48p8-g2fx-3wwm)\n- [National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-54526)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54526) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-13T17:32:46.863393Z"}, {"uuid": "096ca952-cd68-4d4a-9a80-efbb0f5f7b58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "seen", "source": "https://t.me/GithubRedTeam/92588", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-54520\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:50:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-54520 / GHSA-cm8g-8jfq-887p: ai-agent-automation workflow path traversal advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:07.093237Z"}, {"uuid": "5a8260ae-473f-46d4-bdc2-6b7770dc27c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "seen", "source": "https://t.me/GithubRedTeam/92588", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-54520\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:50:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-54520 / GHSA-cm8g-8jfq-887p: ai-agent-automation workflow path traversal advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:10.340610Z"}, {"uuid": "2864ce71-8d8c-44bb-a5d4-c7df9062d125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54527", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mqlgjy4pgm23", "content": "Daily IT Security Digest \u2014 2026-07-14\nScripting (CVE-2026-54527)\nA critical XSS vulnerability in jupyterlab-git (versions below 0.54.0) allows malicious Git filenames to execute JavaScript when viewed in the Git History tab, risking session hijacking and data theft. Users should upgrade to version", "creation_timestamp": "2026-07-14T05:03:16.347146Z"}, {"uuid": "8efa7ed0-df39-4bde-a83d-09bb7cfe55f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92588", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-54520\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a chaitanyagarware\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-09 00:50:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-54520 / GHSA-cm8g-8jfq-887p: ai-agent-automation workflow path traversal advisory landing page\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:33.234417Z"}, {"uuid": "5aef48d2-9250-42e9-bb3d-80e4876deb33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54527", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mqnvcdm2qd2u", "content": "Top 3 CVE for last 7 days:\nCVE-2026-43499: 26 interactions\nCVE-2026-20262: 14 interactions\nCVE-2026-44747: 14 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-44747: 14 interactions\nCVE-2026-47295: 6 interactions\nCVE-2026-54527: 6 interactions\n", "creation_timestamp": "2026-07-15T04:32:45.656082Z"}, {"uuid": "424e54ab-91f8-492c-888e-86af4a8bdd60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54527", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqqofao77726", "content": "\ud83d\udccc CVE-2026-54527 - JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directl... https://www.cyberhub.blog/cves/CVE-2026-54527", "creation_timestamp": "2026-07-16T07:07:06.949705Z"}, {"uuid": "4269fc7c-b13e-4fa6-b2ee-c4c20efc8cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54523", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtypdfugfq26", "content": "\ud83d\udd34 CVE-2026-54523 - Critical (9.6)\n\nKyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 unti...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54523/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-26T16:00:52.498583Z"}, {"uuid": "38595911-04ae-4e3d-bdd7-4ad54fd0dfb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54523", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtypc3nslg2t", "content": "CVE-2026-54523 - kyverno\nKyverno version 1.18.0 and 1.18.1 allow a user who can define a policy in their own area to tell Kyverno to add role\u2011binding objects in any other area, including the system area.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#kyverno #Golang #CVE #infosec", "creation_timestamp": "2026-08-26T16:00:11.391526Z"}, {"uuid": "76354a1d-2a4e-4c25-b892-0113ee039224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "seen", "source": "Telegram/TEdnFjEKS3swNxbVpw8DxCu_Qb9xpCKjEBb-BvgmHVTvT6s", "content": "", "creation_timestamp": "2026-07-16T19:00:15.796465Z"}, {"uuid": "6b7c9f57-aafd-443f-a54c-6e49b04f0552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "seen", "source": "Telegram/uxGFUVPy3TOzkodNgeg8vepR-kYpq91Dg5jOn-NGrDlDjCc", "content": "", "creation_timestamp": "2026-07-16T19:00:16.167914Z"}, {"uuid": "d837035d-91a3-4d51-a23d-4efe6fc795a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54526", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqs457pjpd2l", "content": "CVE-2026-54526 - Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing\nCVE ID : CVE-2026-54526\n \n Published : July 16, 2026, 7:16 p.m. | 18\u00a0minutes ago\n \n Description : Argo Workflows is an open source container-...", "creation_timestamp": "2026-07-16T20:45:48.894234Z"}, {"uuid": "65b2427f-73bf-4f30-82ff-a27aa8ba0430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "seen", "source": "Telegram/TEdnFjEKS3swNxbVpw8DxCu_Qb9xpCKjEBb-BvgmHVTvT6s", "content": "", "creation_timestamp": "2026-07-17T00:00:31.256311Z"}, {"uuid": "a088a44e-6099-4976-8137-e4184b5b2cf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "seen", "source": "Telegram/uxGFUVPy3TOzkodNgeg8vepR-kYpq91Dg5jOn-NGrDlDjCc", "content": "", "creation_timestamp": "2026-07-17T00:00:31.613981Z"}, {"uuid": "d92cb8a1-def5-4c45-9901-ad1c5faf4e30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54523", "type": "published-proof-of-concept", "source": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9", "content": "", "creation_timestamp": "2026-08-26T16:35:18.156190Z"}, {"uuid": "83ceb13d-7ec7-47a6-9fb0-0e387c2a8750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54523", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqtt7pkz5a2v", "content": "Kyverno vulnerability CVE-2026-54523 (CVSS 9.6) is public with PoC exploit code. It lets a tenant gain admin in any namespace. Update to v1.18.2.\n\n#Kyverno #CVE202654523 #PrivilegeEscalation #Kubernetes #CyberSecurity", "creation_timestamp": "2026-07-17T13:11:29.004847Z"}, {"uuid": "17ff7c47-1e64-4af6-83ff-83229f9d2146", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-54523", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116936632297942265", "content": "\u203c\ufe0f New Dark Web Informer Blog Post!\nTitle: One Namespace String to kube-system: Cross-Namespace Privilege Escalation in Kyverno (CVE-2026-54523)\nLink: https://darkwebinformer.com/one-namespace-string-to-kube-system-cross-namespace-privilege-escalation-in-kyverno-cve-2026-54523/\n\ud83d\udca5 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing", "creation_timestamp": "2026-07-17T18:03:26.413269Z"}, {"uuid": "c00f977e-ec97-4c23-8d21-af66fd08c9c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "published-proof-of-concept", "source": "Telegram/TEdnFjEKS3swNxbVpw8DxCu_Qb9xpCKjEBb-BvgmHVTvT6s", "content": "", "creation_timestamp": "2026-07-18T00:00:41.463070Z"}, {"uuid": "2138cdab-e4b3-4c3e-b901-c500f0d4be6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54520", "type": "seen", "source": "Telegram/uxGFUVPy3TOzkodNgeg8vepR-kYpq91Dg5jOn-NGrDlDjCc", "content": "", "creation_timestamp": "2026-07-18T00:00:41.050040Z"}, {"uuid": "41a889ff-625c-4913-bdba-6568b8c83542", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54523", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqzehcl4ei2j", "content": "\u2638\ufe0f TREND: Kyverno flaw CVE-2026-54523 (CVSS 9.6) now has a public PoC \u2014 any user who can create a namespaced Policy can ride Kyverno's admission-controller identity to admin ANY namespace, bypassing RBAC. If you run Kyverno, patch and audit Policy writers. Src: GitHub Advisory", "creation_timestamp": "2026-07-19T18:03:15.974521Z"}, {"uuid": "47099027-6cba-4311-b8af-0bcc802b83fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54523", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtywfpuqy425", "content": "\ud83d\udea8 CVE-2026-54523 \u2014 CVSS 9.6 CRITICAL\n\nKyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-54523\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-26T18:07:24.698457Z"}]}