CVE-2026-52776

creationtimestamp| type| source ---|---|--- 2026-08-12 16:35:03+00:00| published-proof-of-concept| https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-h47f-gmjp-m7rr...

GHSA-H47F-GMJP-M7RR compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Summary compliance-trestle 4.0.3 latest ships an URLSecurityValidator in trestle/core/remote/security.py to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be bypassed by four equivalent...

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Summary compliance-trestle 4.0.3 latest ships an URLSecurityValidator in trestle/core/remote/security.py to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be bypassed by four equivalent...

Server-side Request Forgery (SSRF)

Overview compliance-trestle is a Tools to manage & autogenerate python objects representing the OSCAL layers/models Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the validateurl function in trestle/core/remote/security.py via IPv4-mapped IPv6 addresses an...

CVE-2026-73288

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

CVE-2026-73288 RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

CVE-2026-73288

CVE-2026-73288 affects RustFS prior to 1.0.0-rc.1, where Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs misclassifies ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration. This allows objects under COMPLIANCE retention...

CVE-2026-73288 RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

CVE-2026-73288 RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

Important: Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update

An updated OpenShift File Integrity Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift File Integrity Operator v1.4.1 is now available. See the documentation for bug fix information:...

RHSA-2026:54183 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

PT-2026-71091

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object lock/objectlock sys.rs lets check object lock for deletion, delete prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable...

PT-2026-76563

Name of the Vulnerable Software and Affected Versions compliance-trestle versions prior to 4.0.4 Description An incomplete allowlist in the URLSecurityValidator within trestle/core/remote/security.py allows Server-Side Request Forgery SSRF via the HTTPSFetcher and SFTPFetcher remote-fetch paths...

CVE-2026-73288: Protection Mechanism Failure

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...

MINI-GV99-P9WC-55JM

Bulletin has no description...

SUSE SLES15 Security Update : azure-storage-azcopy (SUSE-SU-2026:3528-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3528-1 advisory. Update to 10.32.6. Security issues fixed: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded...

Meta ordered to pay $942 million over harm to children

A New Mexico court has ordered Meta to pay a total of $942 million after finding that Facebook and Instagram harmed young users and that the company misled consumers about the safety of its platforms. Reportedly, the decision combines a $375 million civil-penalty verdict from March with a newly...

CVE-2026-68481

In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and...

EUVD-2025-210630

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

kube-bench v0.16.0

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark. Tests are configured with YAML files, making this tool easy to update as test specifications evolve. CIS Scanning as part of Trivy and the Trivy Operator Triv...