|
661
|
5.4 |
MEDIUM
Network
|
linuxfoundation
|
tekton_pipelines
|
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restr…
Update
|
CWE-22
Path Traversal
|
CVE-2026-40923
|
2026-04-28 03:07 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
662
|
6.5 |
MEDIUM
Network
|
linuxfoundation
|
tekton_pipelines
|
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response…
Update
|
CWE-400
Uncontrolled Resource Consumption
|
CVE-2026-40924
|
2026-04-28 03:06 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
663
|
7.5 |
HIGH
Network
|
lxml
|
lxml
|
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML in…
Update
|
CWE-611
XXE
|
CVE-2026-41066
|
2026-04-28 02:59 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
664
|
7.7 |
HIGH
Network
|
kyverno
|
kyverno
|
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user wit…
Update
|
CWE-617
Reachable Assertion
|
CVE-2026-41485
|
2026-04-28 02:54 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
665
|
9.1 |
CRITICAL
Network
|
kyverno
|
kyverno
|
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attache…
Update
|
CWE-200
CWE-918
Information Exposure
Server-Side Request Forgery (SSRF)
|
CVE-2026-41323
|
2026-04-28 02:53 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
666
|
7.5 |
HIGH
Network
|
patrickjuchli
|
basic-ftp
|
basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A mal…
Update
|
CWE-400
CWE-770
Uncontrolled Resource Consumption
Allocation of Resources Without Limits or Throttling
|
CVE-2026-41324
|
2026-04-28 02:48 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
667
|
7.7 |
HIGH
Network
|
kyverno
|
kyverno
|
Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating t…
Update
|
CWE-863
Incorrect Authorization
|
CVE-2026-41068
|
2026-04-28 02:48 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
668
|
6.1 |
MEDIUM
Network
|
freerdp
|
freerdp
|
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot…
Update
|
CWE-193
Off-by-one Error
|
CVE-2026-40254
|
2026-04-28 02:44 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
669
|
5.5 |
MEDIUM
Local
|
angryip
|
angry_ip_scanner
|
Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers ca…
Update
|
CWE-787
Out-of-bounds Write
|
CVE-2018-25262
|
2026-04-28 02:30 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
670
|
7.8 |
HIGH
Local
|
lizardsystems
|
lanspy
|
LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attac…
Update
|
CWE-787
Out-of-bounds Write
|
CVE-2018-25265
|
2026-04-28 02:28 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
