CVE-2026-10517

Rejected reason: Retracted following review by Red Hat Product Security and confirmation from the upstream Clair/Claircore maintainer. This CVE misattributes the described behavior to github.com/quay/claircore: the authentication mechanism in question (optional PSK, HTTP endpoint /indexer/api/v1/index_report) is implemented entirely in github.com/quay/clair; no PSK-related code exists anywhere in claircore's codebase or git history. The unauthenticated indexer API is Clair's documented, intentional design, authentication is an opt-in deployment choice, not a code defect. No fix commit was found in claircore between the version recorded as the affected boundary (1.5.52) and the following release (1.5.53); intervening commits are unrelated dependency and feature changes, so the "fixed in 1.5.52" status is inaccurate.

Published

Jun 1, 2026

Last Modified

Jul 27, 2026

Status

Rejected

• CVE-2026-1050A flaw has been found in risesoft-y9 Digital-Infrastructure …7.3
• CVE-2026-1051The Newsletter – Send awesome emails from WordPress plugin f…4.3
• CVE-2026-10510Cross-Site Scripting (XSS) in GeniexWebView component in Tra…6.1
• CVE-2026-10512The X25519 x86_64 assembly implementation fails to clear the…7.5
• CVE-2026-10513The Webmention plugin for WordPress is vulnerable to Stored …7.2
• CVE-2026-10514A vulnerability has been found in 1Panel-dev CordysCRM up to…2.4
• CVE-2026-10520An OS Command Injection vulnerability in Ivanti Sentry befor…10
• CVE-2026-10521An high privileged remote attacker can access a hidden confi…8.6
• CVE-2026-10522The MemberHero WordPress plugin through 6.9 does not restri…9.8
• CVE-2026-10523An Authentication Bypass vulnerability (CWE-288) in Ivanti S…9.8
• CVE-2026-10524The CoCart WordPress plugin before 4.9.0 does not validate a…7.5
• CVE-2026-10525The NEX-Forms WordPress plugin before 9.2.3 does not saniti…6.1