CVE-2026-15687

LOW2.4

Published 2026-07-23 · Updated 2026-07-23 · Source jordan@liggitt.net

Description

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CWE-22

References

https://github.com/kubernetes-client/java/issues/4861

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-66011
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.
2026-07-25 · score 3.3
CVE-2026-17039
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
2026-07-24 · score 3.1
CVE-2026-12690
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
2026-07-24 · score 3.8
CVE-2026-64800
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
2026-07-23 · score 3.5
CVE-2026-52686
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
2026-07-23 · score 3.7