Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20.
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20.
A timing side-channel vulnerability in Traefik's BasicAuth middleware on the v3.6 line allows unauthenticated attackers to enumerate valid usernames under concurrent request conditions. The issue arises from how concurrent credential checks are coalesced using a singleflight.Group key that depends on stored secrets, causing different timing responses for existing versus non-existent usernames. This vulnerability does not allow credential disclosure or authentication bypass. The flaw affects Traefik versions from 3.6.11 up to but not including 3.7.13. The vulnerability has been fixed in version 3.7.13.
CVE-2026-79767 is an authorization bypass vulnerability in the Gardener API server's customverbauthorizer admission plugin. The vulnerability arises because the authorization check for the 'manage-members' custom verb only enforces permissions on User-kind subjects, ignoring Group and ServiceAccount subjects. This allows a project admin without 'manage-members' permission to add arbitrary Group subjects, such as 'system:authenticated', to a project's member list, effectively granting all authenticated users full project-level access.
The Hatchet SNS UnsubscribeConfirmation handler contains a Server-Side Request Forgery (SSRF) vulnerability due to an unvalidated HTTP GET request to an unsigned UnsubscribeURL field. This allows an attacker to bypass signature verification and make arbitrary internal network requests, including to the EC2 Instance Metadata Service (IMDS). The vulnerability affects versions prior to 0.91.1 and has been fixed in version 0.91.1.
The k8saudit plugin's default rules did not inspect security-relevant settings on Kubernetes initContainers and ephemeralContainers, only regular containers. This allowed pod creators to run privileged or otherwise sensitive containers in these container types without triggering the default 'Create Privileged Pod' detection rule. The issue affects k8saudit and its cloud-provider variants. A fix was released in k8saudit 0.18.0 and corresponding cloud variants on 2026-06-19. Until upgraded, restricting pod creation and enforcing Pod Security Admission or admission controllers can mitigate risk.
Hatchet versions up to v0.86.26 are vulnerable to an OAuth state Cross-Site Request Forgery (CSRF) vulnerability. The flaw arises because the session key for OAuth state is cleared to an empty string instead of being removed after a successful OAuth callback. This allows an attacker to reuse an empty state parameter to bind a victim's authenticated session to an attacker-controlled OAuth identity, enabling login CSRF or account takeover. The vulnerability affects deployments with enabled Google, GitHub, or Slack OAuth integrations where the victim has completed at least one OAuth flow in the current session. The issue is fixed in version 0.91.1.
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.
nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.
nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.
Obot versions up to 0.22.1 have a server-side request forgery (SSRF) vulnerability where privileged users can register remote MCP server URLs that Obot fetches without proper destination validation. This allows requests to internal network services and the cloud metadata endpoint (169.254.169.254), potentially exposing cloud IAM credentials. The vulnerability is fixed in version 0.23.0 by enforcing outbound egress restrictions on loopback, link-local, private IP ranges, and IPv6 ULA addresses.
Obot versions up to 0.22.1 with registry authentication enabled do not properly enforce authentication on the MCP Registry API endpoints under /v0.1/*. This allows unauthenticated users to read registry server metadata such as names, descriptions, repository URLs, icons, and connect URLs. No secret credentials or environment variables are exposed, and connecting to servers remains protected by authentication. The issue is fixed in version 0.23.0 and later.
Obot versions up to 0.22.1 with authentication enabled are vulnerable to an OAuth dynamic client registration flaw that allows an attacker to steal API tokens via audience confusion. An unauthenticated attacker can register an OAuth client with an arbitrary redirect URI, and the authorization flow auto-completes without user consent. If a logged-in user visits a crafted authorization URL, the attacker receives an authorization code that can be exchanged for an access token carrying the victim's full group permissions. This token can be used against API endpoints the victim is authorized for, enabling unauthorized access until token revocation. The vulnerability is fixed in version 0.23.0 with added consent screens, token audience restrictions, and validation.
CoreDNS versions prior to 1.14.7 improperly accepted DNS UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC transports, allowing unauthenticated clients to send DNS UPDATE requests through the proxy/forward plugin to upstream DNS servers. This bypassed the opcode rejection enforced on UDP and TCP transports, potentially enabling unauthorized DNS record modifications if the upstream trusts CoreDNS's source or connection without end-to-end TSIG authentication. A fix is available that enforces the correct request policy on all affected transports before dispatch.
CoreDNS versions prior to 1.14.7 contain a vulnerability in their custom transport implementations for DNS-over-HTTPS (DoH/DoH3), DNS-over-QUIC (DoQ), and DNS-over-gRPC. An unauthenticated attacker can craft DNS requests with maliciously large section counts using DNS name compression, causing excessive memory allocation during request unpacking. This can lead to memory exhaustion and termination of the CoreDNS process. The issue arises because CoreDNS bypasses early validation of DNS section counts that is present in the underlying miekg/dns UDP and TCP server implementations. A patch is available that applies proper validation before unpacking requests to prevent this memory exhaustion.
OpenFGA versions prior to 1.18.1 contain a vulnerability in the ListUsers API where it may return users who should have been excluded based on complex authorization model conditions involving intersections and exclusions with type-bound wildcards. This flaw can cause incorrect user enumeration or access enforcement.
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
CVE-2026-81872 is a medium severity availability vulnerability in the open-telemetry opentelemetry-go SDK. The BatchingProcessor in sdk/log can enter a tight CPU loop when the asynchronous export buffer is full and the exporter is backpressured. This causes repeated immediate export retries, leading to CPU exhaustion and denial of service in the affected application. The issue affects versions prior to 0.21.0. No official patch or fix status is provided in the input data.
CVE-2026-81869 is a medium severity vulnerability in the OpenTelemetry Go SDK trace package that allows bypass of the configured attribute value length limit for string attributes containing the Unicode replacement character U+FFFD. This flaw causes oversized attacker-controlled attribute values to be stored untruncated, weakening memory and denial-of-service protections. The vulnerability requires deployments with attribute value length limits enabled and attacker-controlled data recorded into span attributes. There is no indication of confidentiality or integrity impact.