Kyverno versions prior to 1.19.2 have a denial-of-service vulnerability in the In and NotIn operators. This flaw allows attackers to crash the policy engine by submitting resources that cause a panic due to unchecked type assertions when JMESPath expressions evaluate to arrays containing integers, booleans, or mixed types. The crash disrupts admission control and policy enforcement.
Kyverno versions from 1.19.1 up to but not including 1.19.2 contain a vulnerability where the Policy's context.apiCall urlPath is validated after cleaning but executed using the raw path. This allows a namespace-scoped user with Policy creation permissions to craft a urlPath containing hidden '../' segments behind '#' or '?' characters to access cluster-scoped endpoints with Kyverno's ServiceAccount privileges, effectively gaining cluster admin rights.
Kyverno versions 1.18.0 up to but not including 1.19.2 contain a vulnerability in the verifyImages function where signature verification can be bypassed. This occurs because cached verification results are keyed by image reference strings (e.g., tags) rather than the verified image digest. An attacker able to submit workloads and manipulate registry tags can exploit this to bypass signature and attestation checks, causing Kyverno to admit workloads with unverified images.
Kyverno versions prior to 1.19.2 have a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory resources. This occurs because CEL expressions are evaluated without runtime cost limits, enabling attackers to create policies with nested map comprehensions over large ConfigMap fields. Exploitation can cause Kyverno pods to be OOM-killed and block cluster-wide admission.
Kyverno versions before 1.19.2 have an authorization bypass vulnerability in the Generation Handler. This flaw allows users with create or update permissions to spoof internal labels and trigger synchronized generate policies improperly. Exploiting this, attackers can label a ConfigMap as managed by Kyverno with crafted labels to clone sensitive Secrets from restricted namespaces into their own namespace.
Kyverno versions prior to 1.19.2 have a policy bypass vulnerability in the admissionpolicygenerator controller. This flaw allows users with namespaced create rights on PolicyExceptions to inject negated matchConditions into generated ValidatingAdmissionPolicies, bypassing cluster-wide policy enforcement. The vulnerability arises because the controller folds PolicyExceptions into generated policies while ignoring certain gates like --enablePolicyException, --exceptionNamespace, and policy kind gates.
Kyverno versions prior to 1.19.2 have a denial of service vulnerability where namespaced policy authors can submit specially crafted wildcard patterns. This causes excessive CPU usage in the admission controller, leading to cluster-wide webhook timeouts that block resource operations.
Kyverno versions before 1.19.2 have a denial of service vulnerability in the substituteVariablesIfAny function. This flaw allows low-privileged users to cause the admission webhook to hang by creating self-referential variable templates. The attack triggers unbounded substitution loops that exhaust CPU and memory resources, blocking cluster-wide admission.
Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace administrators to escape their namespace confinement by exploiting the cleanup controller's context loader, which is built with a nil policy. Attackers can leverage this to read Secrets across namespaces and modify validating webhook configurations using the cleanup controller's ServiceAccount.
Kyverno versions prior to 1.19.2 have a critical privilege escalation vulnerability. This flaw allows namespace administrators to create resources beyond their assigned RBAC permissions. The issue arises because generate-rule admission checks validate the controller's permissions instead of the resource author's. Consequently, attackers can craft namespaced Policies with generate rules that target other namespaces or cluster-scoped resources, causing the background controller to create or clone resources across the cluster.
Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace tenants to overwrite resources in other namespaces by exploiting the NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can craft a CEL map literal that fabricates a target with a chosen metadata.namespace, enabling the privileged background controller to overwrite sensitive cluster-wide resources such as Secrets, Deployments, or policies.
A path traversal weakness exists in Edge0-AI Audio8_TTS affecting the ArkTtsRuntime.__init__ function in the Model Path Resolution component. Manipulating the slow_decode_models argument can lead to unauthorized file path access. The vulnerability is remotely exploitable and public exploit code is available. The product uses a rolling release system, so specific affected versions are not disclosed. The project has been notified but has not yet responded or issued a fix.
Parse Server versions before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 have an information disclosure vulnerability where object create responses include field values even if the caller lacks read access via class-level permissions or ACL. This allows attackers with create permissions to obtain sensitive values set by Cloud Code triggers, schema defaults, or class default ACLs.
A security vulnerability (CVE-2026-122160) exists in myshell-ai AIlice up to version 0.4.0 in the LoadModel_PEFT function of the HuggingFace Model Wrapper component. The vulnerability arises from improper handling of the base_model_name_or_path argument, allowing inclusion of functionality from an untrusted control sphere. The vulnerability can be exploited remotely and has been publicly disclosed. No patch or vendor response has been reported yet. The CVSS score is 6.3, indicating a medium severity.
A vulnerability in OpenPPL's ppl.nn CUDA Optimizer component allows remote attackers to cause an out-of-bounds read via manipulation of specific arguments in the OptGraph::InitQuantization function. The flaw affects versions up to commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5. No versioning is used, and no fix has been issued yet. The vulnerability has a CVSS score of 6.3, indicating medium severity, and public exploit details are available.
A path traversal vulnerability exists in DeepGraphLearning KnowledgeGraphEmbedding in the override_config function of codes/run.py related to checkpoint loading. This flaw allows remote attackers to manipulate the data_path argument to access unauthorized filesystem locations. The vulnerability has a CVSS score of 6.3 (medium severity). Exploit code has been published, but no patch or fixed version information is currently available. The project has been notified but has not responded or issued a fix. Due to continuous delivery with rolling releases, no specific affected or fixed versions are identified.
A cross-site request forgery (CSRF) vulnerability exists in Presenton versions up to 0.9.11-beta in the JSON.parse function of the /api/user-config endpoint within the User Configuration Handler component. This vulnerability allows remote attackers to manipulate user configuration via CSRF attacks. The issue is addressed by upgrading to version 0.9.12-beta.
A security flaw in InvoiceShelf versions up to 2.4.3 and 3.0.0-alpha.3 allows improper access control due to manipulation of the companies[].id and companies[].role arguments in the MemberService::create function. This vulnerability can be exploited remotely and public exploit code is available. Upgrading to versions 2.4.4 or 3.0.0-alpha.4 resolves the issue.
A vulnerability in purocean Yank Note version 3.93.0 affects the config.getAll function in the Settings Endpoint, leading to information disclosure. The issue can be exploited remotely without authentication. A public exploit exists. Upgrading to version 3.93.1 resolves the vulnerability by removing the sensitive key from the response.