opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0

Vulnerabilities (1,719)

• CVE-2026-45021MedMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the co

• CVE-2026-46358May 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ### Impact OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review le

• CVE-2026-45808higMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  # Impact OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. #

• CVE-2026-9098CriMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or del

• CVE-2026-9097CriMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject

• CVE-2026-9096HigMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that

• CVE-2026-9094CriMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target a

• CVE-2026-9093CriMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects Wa

• CVE-2026-9091MedMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authentica

• CVE-2026-9090CriMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of usin

• CVE-2026-6720HigMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (wi

• CVE-2026-44543HigMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used

• CVE-2026-44477CriMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session wit

• CVE-2026-41185MedMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at

• CVE-2026-41184MedMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer

• CVE-2026-44594HigMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to r

• CVE-2026-44593HigMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first retrieves a response from legacyServer, parses the incoming request path, and ultimately writes the data to storage via buildStorage.Put. The router concatenates t

• CVE-2026-9804HigMay 28, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (

• CVE-2026-9739CriMay 27, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initializati

• CVE-2026-47243higMay 27, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ### Summary In the runtime-rs standalone virtio-fs path, verified here with QEMU (and verified with Cloud Hypervisor too), Kata Containers runs host `virtiofsd` as root with: ``` --sandbox none --seccomp none ``` If an attacker has root-equivalent execution inside the Kata gue