GHSA-XH87-MX6M-69F3 Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo

Summary When using the AWS Lambda adapter hono/aws-lambda behind an Application Load Balancer ALB, the getConnInfo function incorrectly selected the first value from the X-Forwarded-For header. Because AWS ALB appends the real client IP address to the end of the X-Forwarded-For header, the first...

Ubuntu: Security Advisory (USN-8015-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8013-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-25492

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-api, flux, promxy, victoriametrics-cluster, knative-serving, langfuse, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, rancher-telemetry, croc, crossplane-provider-azure-sql, scorecard,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: multus-cni, kubernetes-dashboard-api, go-bindata, flux, trust-manager, promxy, victoriametrics-cluster, knative-serving, gitea, langfuse, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, elvish, rancher-telemetry, croc,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: multus-cni, kubernetes-dashboard-api, go-bindata, flux, trust-manager, promxy, victoriametrics-cluster, knative-serving, gitea, langfuse, terraform-mcp-server, flux-source-controller, minio-object-browser, terraform-docs, elvish, rancher-telemetry, croc,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, podman-fips, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, podman-fips, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: azuredisk-csi-fips, consul, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, podman-fips, consul-k8s, nginx-prometheus-exporter, vault-secrets-webhook, zabbix-agent2, nfs-subdir-external-provisioner,...

Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Summary - The saveimagesAsset graphql mutation allows a user to give a url of an image to download. Url must use a domain, not a raw IP. - Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 special AWS metadata IP - Attacker invokes saveimagesAsset with url...

CVE-2026-25492 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

PT-2026-7142

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save images Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...

Ubuntu: Security Advisory (USN-8015-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8013-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8014-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Medium: aws-nitro-enclaves-cli

Issue Overview: openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Affected Packages: aws-nitro-enclaves-cli Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ sectio...

Medium: aws-nitro-enclaves-cli

Issue Overview: openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Affected Packages: aws-nitro-enclaves-cli Issue Correction: Run dnf update aws-nitro-enclaves-cli --releasever 2023.10.20260202 or dnf update --advisory ALAS2023-2026-1371 --releasever 2023.10.202602...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: mariadb-operator, gitlab-operator-fips, opentelemetry-operator, percona-server-mongodb-operator-fips, opentelemetry-operator-fips, step-issuer-fips, aws-privateca-issuer-fips, cert-manager-csi-driver, cert-manager-webhook-pdns, cert-manager-csi-driver-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, opentelemetry-operator, cert-manager-csi-driver, cert-manager-webhook-pdns, cert-manager-istio-csr, aws-privateca-issuer, cert-manager-cmctl, mariadb-operator, step-issuer...