🕵️ RESEARCH & DEEP DIVES
CVE-2026-89060: Cross-namespace secret disclosure in stolostron multicluster-observability-addon
A flaw in Red Hat's multicluster-observability-addon lets a managed-cluster identity read hub Secrets from outside its namespace.- Affects Red Hat's stolostron/multicluster-observability-addon (CVE-2026-89060), rated HIGH 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
- A managed-cluster identity can reference configuration resources outside its designated namespace due to authorization performed before parsing and canonicalization
- This can disclose sensitive hub Secrets to an attacker-controlled managed cluster
- Reported to Red Hat and made public on 2026-09-10; fix tracked in GitHub PR #644 and RHBZ#2531596
live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-s... — CVE ThreatInt
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an ... — CVE ThreatInt
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject... — CVE ThreatInt
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATC... — CVE ThreatInt
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overf... — CVE ThreatInt
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-b... — CVE ThreatInt
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback ... — CVE ThreatInt
Themify – WooCommerce Product Filter through 1.5.5 - Reflected Cross-Site Scriptin... — CVE ThreatInt
UsersWP through 1.2.70 - Authenticated (Subscriber+) Arbitrary File DeletionThe Us... — CVE ThreatInt
HUSKY through 1.4.3 - Reflected Cross-Site ScriptingThe HUSKY – Products Filter Pr... — CVE ThreatInt
Relevanssi through 4.28.1 - Reflected Cross-Site ScriptingThe Relevanssi – A Bette... — CVE ThreatInt
Booktics – Booking Calendar for Appointments and Service Businesses through 1.0.23... — CVE ThreatInt
Vigilant through 2.10.2 - Unauthenticated Stored Cross-Site ScriptingThe Vigilant ... — CVE ThreatInt
MIPL Grouped Checkout Fields for WooCommerce through 1.2.2 - Unauthenticated Arbit... — CVE ThreatInt
WP-Members Membership Plugin through 3.5.6 - Reflected Cross-Site ScriptingThe WP-... — CVE ThreatInt
Unlimited Elements For Elementor through 2.0.16 - Unauthenticated SQL InjectionThe... — CVE ThreatInt
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeCh... — CVE ThreatInt
Simple Ajax Chat through 20260811 - Unauthenticated Stored Cross-Site ScriptingThe... — CVE ThreatInt
Remote Desktop Services Failures on Windows Servers Following September Update — Cyber Security News
Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Spy Through Microphone — Cyber Security News
Autonomous Systems Emissions Index — r/netsec