rubygem-katello: SQL injection in Registry Proxy via labels

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...

CVE-2026-96577

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-96577

A vulnerability exists in oc-mirror (specifically identified in release-4.21 ) where the embedded local cache registry binds to all network interfaces during mirroring operations. The service lacks authentication and encryption , failing to restrict access to the local system. An unauthenticated ...

EUVD-2026-90590

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-96577 Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-96577 Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

ROOT-APP-NPM-CVE-2026-77078 CVE-2026-77078 in multer - Patched by Root

Root has patched CVE-2026-77078 in the multer package for Root:npm. Multiple fixed versions available...

CVE-2026-56097: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...

CVE-2026-96577: Missing Authentication for Critical Function

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CentOS Linux 6 [TuxCare] Security Update: libsmbclient / libsmbclient-devel / samba / samba-client / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1779902912)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1779902912 advisory. - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply ...

PT-2026-103761

Name of the Vulnerable Software and Affected Versions oc-mirror affected versions not specified Description A flaw exists in oc-mirror where the embedded local cache registry binds to all network interfaces without authentication or encryption during mirroring operations, rather than restricting...

Malicious Package

Overview @hrmony/pladddform-partner-registry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious code in fca-raihan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 241006adda5ea773d76d48d874c80a4054215ed18f05de3e392cdd86c0379785 package.json for fca-raihan declares a dependency whose key equals the package's own name fca-raihan with source github:raihan9099/fca-raihan. This i...

Malicious code in @hrmony/pladddform-partner-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e09dd7e6a7777c82ec319c374c862db40d6bf7210991dac9a7a250fda4a259e7 On import, index.js executes a top-level fetch that harvests cloud and container secrets from the installer host and POSTs them to the hardcoded...

MAL-2026-17278 Malicious code in @hrmony/pladddform-partner-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e09dd7e6a7777c82ec319c374c862db40d6bf7210991dac9a7a250fda4a259e7 On import, index.js executes a top-level fetch that harvests cloud and container secrets from the installer host and POSTs them to the hardcoded...

distribution-registry-3.1.1-8.1 on GA media (moderate)

distribution-registry-3.1.1-8.1 on GA media Announcement ID: openSUSE-SU-2026:11872-1 Rating: moderate Cross-References: CVE-2026-81871 CVE-2026-81872 CVSS scores: CVE-2026-81871 SUSE : 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-81872 SUSE : 5.3...

GO-2026-6525 Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot

Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot...

CVE-2026-93537

SUSE Rancher Fleet is vulnerable to a path traversal vulnerability in the Helm valuesFiles component. An attacker with permission to supply bundle content to a GitRepo resource (e.g., via Git push access) can force the system to read arbitrary files from the filesystem of the bundle-processing en...

CVE-2026-101063

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

EUVD-2026-88032

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...