https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 10:16:45 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-75886 <p>A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.</p> <p>A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-75886 https://vulnerability.circl.lu/vuln/ghsa-f8rq-4f8p-cmww <p>A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.</p> <p>A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.</p> https://vulnerability.circl.lu/vuln/ghsa-f8rq-4f8p-cmww https://vulnerability.circl.lu/vuln/rhsa-2026:71447 <p>net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint openshift/console: openshift/console: Unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler</p> <p>net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint openshift/console: openshift/console: Unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler</p> https://vulnerability.circl.lu/vuln/rhsa-2026:71447