34853 matches found
PT-2026-71153
Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.8 Description An issue exists where the is blocked ip function in ufo/utils/url security.py fails to block specific IPv6 prefixes, including NAT64 64:ff9b::/96 and 64:ff9b:1::/48, 6to4 2002::/16, and Teredo...
CVE-2026-73247
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...
CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...
CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...
CVE-2026-73247
Kestra prior to 2.0.0 has a SSRF-like issue in HttpFunction.java: the user-controlled http() URI is passed to URI.create() and used by the server-side HTTP client without restricting private, loopback, or link-local destinations. This allows an unauthenticated attacker to import and execute a flo...
CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...
CVE-2026-71474
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...
CVE-2026-71474
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...
CVE-2026-70348
Improper link resolution before file access 'link following' in Windows Management Services allows an authorized attacker to deny service locally...
CVE-2026-62893
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network...
CVE-2026-62818
Use after free in Active Directory Certificate Services AD CS allows an authorized attacker to execute code over a network...
CVE-2026-62692
Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61367
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61364
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61365
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61357
Use after free in Application Information Services allows an authorized attacker to elevate privileges locally...
CVE-2026-61356
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally...
CVE-2026-28757
Protection mechanism failure for some IntelR Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...