19236 matches found
EUVD-2026-48475
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...
CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...
CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...
CVE-2026-54422
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...
SUSE SLES15 Security Update : google-guest-agent (SUSE-SU-2026:3210-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3210-1 advisory. This update for google-guest-agent fixes the following issue - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...
PT-2026-64295
Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...
PT-2026-64232
Name of the Vulnerable Software and Affected Versions OpenStack Ironic Python Agent versions prior to 11.6.1 Description A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent. This occurs because the value of the ntp server variable is...
PT-2026-64303
Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...
PT-2026-64231
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it...
SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2026:3209-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3209-1 advisory. This update for google-osconfig-agent fixes the following issue - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...
CVE-2026-65604
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...
CVE-2026-65604
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...
CVE-2026-65604
Skipper has an incomplete fix for CVE-2026-50197. Oversized request bodies can bypass Open Policy Agent (OPA) deny-on-presence Rego policies because, when body size exceeds maxBodyBytes, Skipper forwards the full payload while OPA evaluates an empty parsed_body. This means policies that deny requ...
CVE-2026-65604 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...
CVE-2026-16796 Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...
CVE-2026-47722 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...
CVE-2026-47722 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...
CVE-2026-47722 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...
CVE-2026-47722
Nebula-mesh (self-hosted control plane for Slack Nebula) prior to v0.3.2 is affected by YAML injection in host advanced overrides. The root cause is that ListenHost and TunDevice are interpolated directly into a text/template used to generate the agent config.yml, and the web/advanced input has o...