TI-2026-40198 CVE-2026-55677 · GHSA-vfp3-v2gw-7wfq
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Priority HIGH 72
Echo is a Go web framework.
RHSA-2026:52946
Multicluster Global Hub 1.8.1 security update
Released 2026-08-10 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
Fixes 6 records
TI-2026-40371 CVE-2026-55969 · GHSA-x8jh-qfcv-fp29
Integer overflow in Apache Thrift
Priority MEDIUM 46
Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.
TI-2026-38569 CVE-2026-53492 · GHSA-33vj-92qq-66hc
containerd CRI checkpoint restore CDI annotation smuggling
Priority LOW 36
containerd is an open-source container runtime.
TI-2026-25775 CVE-2026-33376 · GHSA-3r2p-7499-27q3
Auth Proxy IPv6 whitelist bypass
Priority LOW 34
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.
TI-2026-25776 CVE-2026-33377 · GHSA-5cv7-h7gr-wjgh
Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
Priority LOW 33
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.
TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r
Inefficient candidate hostname parsing in crypto/x509
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.