Skip to content

cveboard RSS feed

Go

Thursday, October 15
- GitHub CVE-2026-94603
  Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
  - podman-container-tools podman
  - Critical
  - CVSS 10.0
  - EPSS 0.92%
  - Fixed version listed
  20:22 UTC
- GitHub CVE-2026-77524
  KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
  - kedacore keda
  - Critical
  - CVSS 9.9
  - EPSS 0.64%
  - Fixed version listed
  20:19 UTC
- GitHub CVE-2026-77459
  Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
  - argoproj argo-cd
  - Critical
  - CVSS 9.9
  - EPSS 0.72%
  - Fixed version listed
  20:19 UTC
- GitHub CVE-2026-104252
  Vitess vttablet /twopcz reflected XSS
  - vitessio vitess
  - Critical
  - CVSS 9.8
  - EPSS 0.89%
  - Fixed version listed
  20:16 UTC
- GitHub CVE-2026-102748
  Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
  - dgraph-io dgraph
  - Critical
  - CVSS 9.2
  - EPSS 0.49%
  - Fixed version listed
  20:17 UTC
Friday, October 9
- GitHub CVE-2026-68582
  Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
  - go-vikunja vikunja
  - Critical
  - CVSS 9.3
  - EPSS 0.27%
  - Fixed version listed
  20:42 UTC
- GitHub CVE-2026-107806
  Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
  - 0xJacky nginx-ui
  - Critical
  - CVSS 9.0
  - EPSS 0.41%
  - Fixed version listed
  20:45 UTC
Wednesday, October 7
- GitHub CVE-2026-62252
  Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
  - sipcapture homer
  - Critical
  - CVSS 9.8
  - EPSS 0.65%
  - Fixed version listed
  16:12 UTC
- GitHub CVE-2026-62253
  Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
  - sipcapture homer
  - Critical
  - CVSS 9.8
  - EPSS 0.42%
  - Fixed version listed
  16:11 UTC
Friday, October 2
- GitHub CVE-2026-73802
  gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
  - Gitea Gitea Runner
  - Critical
  - CVSS 9.9
  - EPSS 0.47%
  - Fixed version listed
  23:18 UTC
Thursday, October 1
- GitHub CVE-2026-69085
  SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
  - siyuan-note siyuan
  - Critical
  - CVSS 10.0
  - EPSS 1.49%
  - Fixed version listed
  14:38 UTC
Thursday, September 24
- GitHub CVE-2026-61604
  ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
  - ixofoundation ixo-blockchain
  - Critical
  - CVSS 9.3
  - EPSS 0.27%
  - Fixed version listed
  19:22 UTC