Search vulnerabilities

Expected end of text, found ',' (at char 21), (line:1, col:22)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2026-126069

Action View: Possible XSS vulnerability in Action View tag helpers

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, the fix for CVE-2026-33168 skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as :" ", is not blank, because Symbol#blank? is Symbol#empty?, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as image_tag, video_tag and audio_tag, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-122311

Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-18103

Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signature) key authentication, could send a specially crafted lease creation request. This request, containing an overly long InfiniBand MAC address, triggers a buffer overflow in the `print_hw_addr()` function. Successful exploitation leads to a persistent denial of service (DoS), causing the `dhcpd` service to crash and preventing it from restarting without manual intervention.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Dhcp-server Redhat
Products
Dhcp-server Enterprise Linux Rhel Els
CVE-2026-16530

Pcp: pcp: remote denial of service and information leakage

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openshift Container Platform and 1 more
CVE-2026-122312

Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122313

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy

Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target such as another tenant's RoleBinding, which the cluster-wide background controller then mutates to add attacker subjects or alter Roles, NetworkPolicies, and ConfigMaps.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122314

Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic

Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by {{- variable }} shallow substitution in policies, causing a panic that yields webhook denial of service and policy bypass under failurePolicy Ignore.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122315

Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic

Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under failurePolicy Ignore or crash-loop the reports-controller.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-121142

chromium-browser: Incorrect authorization in Network

Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-105720

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-105727

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

External control of file name or path in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Microsoft
Products
Dynamics Nav 2018
CVE-2026-122316

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting

Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122318

Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates

Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122319

Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic

Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-121143

chromium-browser: Uninitialized resource in GPU

Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-122320

Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone

Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim namespace's sensitive ConfigMap into the attacker's namespace, enabling cross-tenant data disclosure.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122321

Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass

Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122322

Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno
CVE-2026-122323

Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Kyverno
Products
Kyverno