Security advisories

medium2026-06-30

CVE-2026-49835-Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

sigstore/timestamp-authority · GHSA-9c54-x2g4-v92j

high2026-06-30

CVE-2026-49478-Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

sigstore/fulcio · GHSA-f5mr-q85p-6hh6

medium2026-06-30

CVE-2026-48796-CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

cefsharp/cefsharp · GHSA-85jm-cwp2-mvpv

high2026-06-30

CVE-2026-48795-@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

adonisjs/core · GHSA-qcm7-3vpr-hj5h

medium2026-06-30

CVE-2026-48592-oban_web missing authorization check on `save-job` event handler

oban-bg/oban_web · GHSA-389x-rgxr-8m33

medium2026-06-30

CVE-2026-48593-oban_web: Unbounded range expansion in cron describe causes memory exhaustion

oban-bg/oban_web · GHSA-6xh2-93p9-vqh4

medium2026-06-30

CVE-2026-49820-Probo has an open redirect bypass via path normalization

getprobo/probo · GHSA-x7qq-m748-8p2c

high2026-06-30

CVE-2026-58168-DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools

hkuds/deeptutor · GHSA-jg88-rvpc-qvxj

high2026-06-30

CVE-2026-58167-Nightingale exposes datasource credentials to low-privilege users

ccfos/nightingale · GHSA-27c6-wp53-387x

critical2026-06-30

CVE-2026-50566-Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

fission/fission · GHSA-m63v-2g9w-2w6v

medium2026-06-30

CVE-2026-50565-Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

fission/fission · GHSA-8wcj-mfrc-jx5q

critical2026-06-30

CVE-2026-50564-Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

fission/fission · GHSA-gx55-f84r-v3r7

critical2026-06-30

CVE-2026-50563-Fission Container Executor Function PodSpec Injection Leading to Node Escape

fission/fission · GHSA-v455-mv2v-5g92

critical2026-06-30

CVE-2026-50545-Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

fission/fission · GHSA-wmgg-3p4h-48x7

high2026-06-30

CVE-2026-49824-Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

fission/fission · GHSA-cvw6-gfvv-953q

high2026-06-30

CVE-2026-49823-Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

fission/fission · GHSA-3r8v-2xmj-5c39

high2026-06-30

CVE-2026-49822-Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

fission/fission · GHSA-gc3j-79f2-7vvw

high2026-06-30

CVE-2026-49821-Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

fission/fission · GHSA-vjhc-cf4p-72q4

high2026-06-30

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

fission/fission · GHSA-7m8x-qg2j-4m3v

low2026-06-30

CVE-2026-48791-Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore/sigstore-java · GHSA-qqw8-7c2r-jxch