Skip to content
Threat Feed
Subscribe

Tag

Supply-Chain-Security

3 briefs RSS
high advisory

CVE-2026-75939 - Signature Verification Bypass in Red Hat oc-mirror

A logic flaw in the oc-mirror tool allows remote attackers to bypass PGP signature verification, enabling the injection of malicious release payloads into disconnected registries.

oc-mirror supply-chain-security cloud red-hat openshift
1t 1c
high advisory

Credential Disclosure in Renovate via Malicious Pagination Links

Renovate improperly validates HTTP 'Link' headers during GitHub API interactions, allowing a compromised GitHub server to exfiltrate configured credentials by redirecting pagination requests to an attacker-controlled host.

Renovate +5 credential-access supply-chain vulnerability supply-chain-security credential-theft nuget dependency-management
1t 1c
high advisory

Sigstore Fulcio Vulnerabilities: OIDC Discovery Redirect Leads to SSRF, JWKS Substitution, and Kubernetes Token Leakage (CVE-2026-49478)

A high-severity vulnerability (CVE-2026-49478) in Sigstore Fulcio's OIDC discovery client allows blind Server-Side Request Forgery (SSRF) via cross-host redirects, facilitates JWKS substitution for cache poisoning, and causes Kubernetes ServiceAccount token leakage to external attackers, potentially compromising supply chain integrity and cluster resources.

Fulcio supply-chain-security kubernetes oidc ssrf jwks cve
4t