Arcane versions prior to 2.6.0 contain an incorrect privilege assignment vulnerability in the UpdateUser function. This flaw allows a user with delegated users:update permission to change the global administrator's password without proper privilege checks, enabling complete takeover of the administrator account. The issue is resolved in version 2.6.0.
Arcane versions prior to 2.11.0 contain an incorrect authorization vulnerability in the AuthMiddleware.managerAuth component. This flaw allows an attacker possessing a valid X-Arcane-Agent-Token to access administrator-restricted Go pprof runtime and diagnostic endpoints without proper admin checks. The vulnerability is fixed in version 2.11.0.
Podman versions 4.4.0 through before 5.8.8 and 6.0.0 through before 6.1.3 contain a vulnerability where the 'podman run' command can be tricked into disabling almost all sandboxing by using an image annotated as a checkpoint. This allows the image to override user-specified container creation options, potentially granting full capabilities and control over the container sandbox. The functionality enabling this behavior has been removed in patched versions.
CVE-2026-95838 is a denial-of-service vulnerability in containerd's layer unpack handler caused by superlinear time complexity during processing of certain image layers with repeated directory traversals. Pulling or importing a maliciously crafted image can significantly delay container startup and increase CPU usage. This can also reduce concurrency for image pulls in orchestrators like Kubernetes, delaying unrelated container deployments. The issue is fixed in containerd versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5. No workarounds exist, so users should update to these versions and only use trusted images until patched.
The Docker distribution client method manifests.Get() does not verify that the manifest content returned by a registry matches the requested digest. This allows a malicious or compromised registry, or a man-in-the-middle attacker, to serve arbitrary manifest content while claiming it matches the requested digest. Applications relying on digest pinning for supply-chain integrity can be silently undermined. The bundled pull-through proxy is also vulnerable, allowing poisoned manifests to be cached and served to other clients.
CVE-2026-95837 is a vulnerability in containerd's CRI plugin that allows containers restored from untrusted checkpoints via the CreateContainer API to bypass the destination security context. This results in processes running with elevated privileges, including root with full capabilities and no seccomp filters, despite restrictive security policies. The vulnerability affects Linux systems running containerd with CRI checkpoint restore enabled. The issue has been fixed by disabling checkpoint restore via CreateContainer by default in versions 2.2.7 and 2.3.4, and the feature was removed entirely in 2.4.0.
A vulnerability in Talos Linux versions prior to 1.14.0-alpha allows private registry credentials to be included in support bundles generated by the `talosctl support` command. These credentials appear in specific YAML files within the bundle, potentially exposing sensitive authentication data if the bundle is shared publicly. The impact is generally low, especially since Talos 1.14+ encrypts support bundles by default. However, if the registry is publicly accessible and credentials have write access, this could lead to denial of service, data loss, or supply chain compromise.
Nginx UI's Casdoor SSO implementation uses a constant OAuth 'state' parameter for all users, which is not validated on callback. This flaw allows an attacker to perform login CSRF by forcing a victim's browser to authenticate as the attacker, potentially leading to unauthorized access and data exfiltration. The vulnerability is fixed in version 1.9.10-0.20260703131214-23d1934099b0 by implementing a per-session random state parameter with validation.
Nginx UI contains a vulnerability (CVE-2026-84313) where endpoints for enrolling TOTP and WebAuthn passkeys do not require re-authentication beyond a valid JWT. This allows an attacker with a stolen JWT to bind their own second factor to a victim's account without needing the victim's password, enabling persistent account takeover even after password resets. The issue arises because these enrollment routes are registered outside the secure session middleware, and there is insufficient verification to prevent multiple or unauthorized enrollments. A patch is available that moves these routes inside the secure session group and recommends requiring the current password for such sensitive actions.
A NULL pointer dereference vulnerability exists in kin-openapi versions from 0.136.0 up to but not including 0.149.0. This flaw allows an unauthenticated remote attacker to cause a deterministic panic by sending crafted requests with array query parameters or specific request bodies. The issue arises from missing nil-items guards in certain decoder paths handling OpenAPI 3.1 array schemas. The vulnerability is fixed in version 0.149.0.
CVE-2026-100354 is a high-severity vulnerability in kin-openapi versions prior to 0.149.0 involving uncontrolled recursion in runtime schema validation. While the spec loader and spec-time validator safely handle circular schema references, the runtime validators lack cycle detection, causing unbounded recursion when validating request or response data against schemas with circular allOf/anyOf/oneOf references. This leads to a fatal stack overflow in Go, crashing the entire server process and terminating all goroutines, including those serving unrelated clients. The vulnerability affects both response validation and request parameter decoding paths. No recoverable panic occurs, making the failure unrecoverable and causing a complete process termination.
kin-openapi versions prior to 0.148.0 improperly handle unusual numeric values such as YAML NaN and infinity during OpenAPI 3.1 validation. This flaw allows a remote unauthenticated client to send specially crafted YAML request bodies containing .nan, .inf, or -.inf values, triggering a panic in the dependency jsonschema v6.0.2. The panic occurs due to dereferencing a nil big.Rat during request validation, which can cause process termination in some hosting environments. The issue is fixed in version 0.148.0.
CVE-2026-100351 is an authentication bypass vulnerability in the kin-openapi library's openapi3filter.ValidationHandler.Middleware. It arises when a downstream gorilla/mux router uses UseEncodedPath(), causing a mismatch between the decoded path used for validation and the encoded path used for routing. This allows an unauthenticated request with an encoded path to bypass authentication and reach a protected handler. The issue affects kin-openapi versions from 0.144.0 up to but not including 0.147.0. The vulnerability can lead to unauthorized execution of protected handlers without invoking the authentication callback.
CVE-2026-100349 is a NULL pointer dereference vulnerability in the kin-openapi library (github.com/getkin/kin-openapi) affecting versions up to 0.145.0. The issue occurs when a response header in an OpenAPI spec declares a 'content' field instead of a 'schema', causing the ValidateResponse function to panic due to a nil pointer dereference. This crash happens even though the document passes validation, leading to a process crash on every call to the affected operation. The vulnerability can cause denial of service if the spec is attacker-controlled or comes from an untrusted source.
CVE-2026-100350 is a medium severity vulnerability in the getkin kin-openapi library affecting versions >=0.145.0 and <0.146.0. It involves uncontrolled resource consumption due to repeated compilation of an invariant regular expression inside a loop over all query keys when decoding deepObject-style query parameters. This causes CPU usage to scale linearly with the number of query keys, enabling denial of service by sending requests with many junk query keys.
CVE-2026-100347 is a medium-severity vulnerability in the getkin kin-openapi library's openapi3filter.ValidationHandler middleware. It occurs because the legacy router matches HTTP methods verbatim against a trie of upper-cased standard methods, causing requests with non-standard or non-canonical HTTP methods (e.g., PROPFIND or lowercase get) to miss the route and trigger a panic. This panic happens before authentication, leading to an unauthenticated, remotely triggerable denial of service via connection aborts and unbounded error log growth. The vulnerability affects versions prior to 0.145.0 and has no known fixes or patches as of the published date.
CVE-2026-100348 is a medium severity vulnerability in the kin-openapi library's openapi3 loader component. It involves a NULL pointer dereference in the resolveComponent function when processing additionalProperties in schema references. This occurs because the code dereferences c.Value.AdditionalProperties without checking if c.Value is nil, leading to a panic during loading of crafted OpenAPI documents. The issue affects kin-openapi versions prior to 0.145.0 and can cause denial of service by crashing applications that load untrusted OpenAPI specifications.
kin-openapi versions from 0.136.0 up to but not including 0.143.0 contain a vulnerability where the openapi3filter component improperly handles OpenAPI 3.1 array schemas missing the 'items' keyword. This leads to a nil-pointer panic during request or response validation when decoding certain content types. The issue does not affect OpenAPI 3.0 documents. The vulnerability is fixed in version 0.143.0.
Dgraph version prior to 25.4.0 has an unauthenticated administrative HTTP interface exposed on port 6080. This interface allows unauthenticated attackers to read cluster state, allocate IDs, and perform destructive membership operations such as removing nodes. Exploitation can disrupt the Zero control plane and destabilize Alpha nodes, resulting in denial of service. The vulnerability arises because administrative endpoints lack authentication or IP whitelisting by default.
KEDA versions 2.20.2 and earlier contain a critical improper privilege management vulnerability. A namespace administrator can exploit this by creating TriggerAuthentication and ScaledObject resources that cause KEDA to send the operator pod's ServiceAccount token to a malicious Vault endpoint. This allows the attacker to gain the operator's cluster-wide permissions, including broad secret access and workload control. The issue is fixed in version 2.21.0.