multicluster_engine_for_kubernetes vulnerabilities
CVEs whose affected-version data names the multicluster_engine_for_kubernetes package (go, npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
82 CVEsRSS
CVE-2026-53669Medium· 5.4react-router: React Router: Open Redirect vulnerability via backslashes in navigation components (CVE-2026-53669)
A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the <Link> or useNavigate components. This could lead …
CVE-2026-45623High· 7.5postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can l…
CVE-2026-66010Medium· 6.1PoCdompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass (CVE-2026-66010)
A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cr…
CVE-2026-46600High· 7.5golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing (CVE-2026-46600)
A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may p…
CVE-2026-16221High· 7.5fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency (CVE-2026-16221)
A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js's native WHATWG URL parser. This discrep…
CVE-2026-59879Medium· 5.3⚖ disputedimmutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations (CVE-2026-59879)
A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a partic…
CVE-2026-53488High· 8.8github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin (CVE-2026-53488)
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversi…
CVE-2026-53492High· 8.2github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint r…
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotat…
CVE-2026-53550Medium· 5.3js-yaml: js-yaml: Denial of Service via crafted YAML merge keys (CVE-2026-53550)
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker can exploit this vulnerability by providing a specially crafted YAML document that repeatedly uses the same alias in a merge sequence. This can lead to alg…
CVE-2026-41568Low· 3.9github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup (CVE-2026-41568)
A flaw was found in the Moby container framework. A race condition during the `docker cp` mount setup allows a malicious container to create empty files or directories at arbitrary locations on the host filesystem. This vulnerability can l…
CVE-2026-42306High· 7.2github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup (…
A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary …
CVE-2026-41178High· 7.5github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denia…
A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length i…
CVE-2026-33244Medium· 5.4react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization (CVE-2026-33244)
A flaw was found in react-router. When using Framework Mode with pre-rendering enabled, an attacker can exploit improper handling of the HTTP `Location` header value. This can lead to Cross-Site Scripting (XSS), allowing malicious scripts …
CVE-2026-44740High· 7.5github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation an…
CVE-2026-44973High· 8.1github.com/go-git/go-billy: Go-billy: Arbitrary file access due to path traversal vulnerability (CVE-2026-44973)
A flaw was found in go-billy, an interface filesystem abstraction for Go. Multiple path traversal vulnerabilities exist due to insufficient path sanitization and boundary enforcement. A remote attacker could exploit this by crafting malici…
CVE-2026-25680Medium· 6.5golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing (CVE-2026-25680)
A flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition,…
CVE-2026-46598Medium· 5.3golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input (CVE-2026-46598)
A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cau…
CVE-2026-39833Medium· 5.5⚖ disputedgolang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation (CVE-2026-39833)
A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before u…
CVE-2026-39827Medium· 6.5golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings (CVE-2026-39827)
A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service (DoS) by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the ser…
CVE-2026-39831High· 8.1golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check (CVE-2026-39831)
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardw…
CVE-2026-39834Medium· 6.5⚖ disputedgolang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write (CVE-2026-39834)
A flaw was found in golang.org/x/crypto/ssh. When a remote attacker attempts to write data larger than 4GB in a single call on an SSH (Secure Shell) channel, an integer overflow occurs in the internal payload size calculation. This vulnera…
CVE-2026-46595High· 7.1PoC⚖ disputedgolang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation (CVE-2026-46595)
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This…
CVE-2026-41506Medium· 6.5golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects (CVE-2026-41506)
A flaw was found in go-git, an extensible Git implementation library for Go. This vulnerability allows an attacker to potentially obtain sensitive HTTP authentication credentials. This can occur when go-git follows redirects during smart-H…
CVE-2026-42501Medium· 5.3cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)
A flaw was found in the Go command (`cmd/go`). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the `go` com…
CVE-2026-39823Medium· 5.4html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)
A flaw was found in the `html/template` package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign (`=`) within a URL's content attribute inside a `<meta>` tag. This improper esc…
CVE-2026-39826Medium· 5.4html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block,…
CVE-2026-39825Medium· 6.5net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2…
A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs becaus…
CVE-2026-39836High· 7.5net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)
A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a speci…
CVE-2026-7163Medium· 6.1A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrativ…
A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrativ…
CVE-2026-6993Medium· 5.3go-kratos: go-kratos kratos: Information disclosure via unintended HTTP server intermediary (CVE-2026-6993)
A flaw was found in go-kratos kratos. A remote attacker could exploit a vulnerability in the HTTP server's `NewServer` function, specifically within the `http.DefaultServeMux Fallback Handler`. This manipulation creates an unintended inter…