Threat database

CVE-2026-33971 is a vulnerability in the LTE RRC component of the Samsung Semiconductor Exynos 850 chipset. It involves improper handling of messages received before authentication, which triggers a data abort and results in a denial-of-service (DoS) condition. A fix for this issue was released in October 2026.

CVE-2026-33969 is a vulnerability in the Samsung Semiconductor Exynos 850 chipset where a missing lower bound check during the NAS Authentication Request message decoding causes an infinite loop. This flaw can lead to a Denial of Service condition. A fix was released in October 2026.

CVE-2026-33972 is a vulnerability in the Samsung Semiconductor Exynos 1080 modem's IMS stack where improper validation of specified quantity leads to an out-of-bounds access. This flaw can cause unexpected behavior or crashes in the affected component. A fix was released in October 2026.

CVE-2026-48179 is a vulnerability in the Samsung Semiconductor Exynos 1080 modem's IMS stack where improper validation of the SDP payload can cause a denial of service. The issue arises from incorrect handling of syntactic correctness in input data. A fix was released in September 2026.

CVE-2026-48176 is a memory corruption vulnerability in the Samsung Semiconductor Exynos 1080 caused by improper validation of specified quantity in input messages. This flaw can lead to memory corruption due to insufficient input validation. A fix was released in September 2026.

CVE-2026-35495 is an improper access control vulnerability in the IMS stack of Samsung Semiconductor's Exynos 1080 chipset. It arises from improper handling of SIP packets, leading to incorrect access control decisions. A fix was released in October 2026.

CVE-2026-122992 is a critical integer underflow vulnerability in G4KLX DStarGateway and F4FXL DStarGateway before commit 7b75de6. The flaw occurs in the function dstarCallsignToAPRS in APRSUtils.cpp when processing an empty RS-MS1A sender field, leading to an integer underflow condition.

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel_PEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument base_model_name_or_path leads to inclusion of functionality from untrusted control sphere. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Kyverno versions from 1.11.0 up to but not including 1.19.2 contain an unbounded decompression vulnerability in the FetchSignatureBlob function. This flaw allows attackers who control registry referrers or signatures to supply highly compressed gzip layers that decompress beyond the configured maxPayloadSize, leading to memory exhaustion. The resulting out-of-memory (OOM) condition can cause the admission controller to crash, resulting in denial of service.

Kyverno versions from 1.11.0 up to but not including 1.19.2 have an unbounded decompression vulnerability in the extractStatement function. This flaw allows remote attackers to supply highly compressed attestation layers that decompress to large sizes, exhausting memory resources. Attackers controlling registry referrer artifacts can push gzip predicate layers that exceed the maximum payload size when decompressed, causing the admission controller to be killed due to out-of-memory (OOM) conditions, resulting in denial of service.

Kyverno versions 1.18.0 up to but not including 1.19.2 contain a time-of-check to time-of-use (TOCTOU) race condition in the verifyImages function. This flaw allows signature verification to be bypassed because cached verification results are keyed by image reference strings (tags) rather than the verified image digest. An attacker able to submit workloads and manipulate registry tags can exploit this to have Kyverno accept unverified images by repointing tags after cache warming.

Kyverno versions before 1.19.2 have a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces. This occurs via templating generate.clone or cloneList namespace values, enabling an attacker to cause the background-controller to copy sensitive ConfigMaps from a victim namespace into the attacker's namespace, resulting in cross-tenant data disclosure.

Kyverno versions before 1.19.2 have a denial-of-service vulnerability in the In and NotIn operators caused by an unchecked type assertion. This flaw allows attackers to crash the policy engine by submitting resources with JMESPath-evaluated values that are arrays of integers, booleans, or mixed types, leading to a panic that disrupts admission control and policy enforcement.

Kyverno versions prior to 1.19.2 contain an authentication bypass vulnerability in the matchCertificateData function. This flaw allows attackers with a leaf certificate from a configured private trust root to bypass subject and subjectRegExp checks if the signing certificate lacks a Subject Alternative Name (SAN). By omitting the SAN and setting the expected Fulcio issuer OID, attackers can sign malicious images that are admitted despite signer pinning. The issue is fixed in version 1.19.2.

Kyverno versions from 1.17.0 up to but not including 1.19.2 have a missing authorization vulnerability in the mutate-existing background processor. This flaw allows namespaced tenants to modify resources outside their own namespace by creating a NamespacedMutatingPolicy targeting Namespace objects or resources in other namespaces. Exploitation can lead to cluster-wide removal of Pod Security labels by the background-controller ServiceAccount.

Kyverno versions before 1.19.2 have an unchecked type assertion vulnerability in the buildStatementMap function. This flaw allows unauthenticated attackers to crash the policy engine by submitting crafted attestation statements. Specifically, attackers can push an OCI referrer manifest containing a non-string type field, which can bypass image verification when failurePolicy is set to Ignore or cause the reports-controller to enter a crash loop.

Kyverno versions before 1.19.2 have an unchecked type assertion vulnerability in the variable-substitution engine. This flaw allows users who can submit resources to cause the policy engine to crash by submitting resources with non-string fields referenced in shallow substitutions. The resulting panic leads to webhook denial of service and potential policy bypass when failurePolicy is set to Ignore. The issue is fixed in version 1.19.2.

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain a critical privilege escalation vulnerability. This flaw allows namespace-scoped tenants to modify resources in other namespaces by exploiting a lack of namespace checks in the NamespacedMutatingPolicy targetMatchConstraints.expression CEL output. Attackers can manipulate cluster-wide background controllers to alter RoleBindings, Roles, NetworkPolicies, and ConfigMaps in other namespaces. The vulnerability is fixed in version 1.19.2.

CVE-2026-122312 is a high-severity vulnerability in Kyverno versions 1.19.1 up to but not including 1.19.2. It involves an improper privilege management issue where a namespace isolation bypass occurs due to incorrect handling of the '?' character in URL paths. This allows users with permission to create namespaced policies to craft URLs that bypass namespace restrictions and access cluster-scoped resources outside their namespace.

Kyverno versions from 1.16.0 up to but not including 1.19.2 contain a path traversal vulnerability in the resource.get() and resource.post() functions. This flaw allows namespaced CEL policies to escape their namespace by inserting '..' segments in the resource argument, enabling unauthorized read and write access to arbitrary cluster objects via the admission controller's ServiceAccount. This can lead to a complete cluster takeover. The issue is fixed in version 1.19.2.