25062 matches found
GHSA-J5JQ-CR68-V2XX Winter: Authenticated backend users can bypass Users controller permission checks
Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests XWINTERREQUESTHANDLER header. The AJAX path validates that handler names match the onA-Z\w+ pattern, but the postback path...
Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.12.1 security update
This is an updated version of the Node Health Check Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Node Health Check Operator deploys the Node Health Check controller. The controller identifies unhealthy nodes and uses a remediation provider to remediate the...
CVE-2025-41771
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...
CVE-2026-72526
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...
EUVD-2026-57058
A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...
CVE-2026-72526
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...
EUVD-2026-57057
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...
CVE-2026-70398
A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...
CVE-2026-19130: Authorization Bypass Through User-Controlled Key
A flaw was found in the provider-credential-controller component of multicluster-engine MCE. An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker...
CVE-2026-73269: Improper Privilege Management
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to...
CVE-2026-73268: Improper Control of Generation of Code
A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...
CVE-2026-70398: Unintended Proxy or Intermediary
A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...
PT-2026-71252
Name of the Vulnerable Software and Affected Versions multicluster engine MCE affected versions not specified Description A flaw in the cluster-curator-controller component allows a tenant with create or update permissions on ClusterCurator resources to inject an arbitrary Job specification. This...
PT-2026-75979
Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests X WINTER REQUEST HANDLER header. The AJAX path validates that handler names match the onA-Zw+ pattern, but the postback path...
PT-2026-71253
Name of the Vulnerable Software and Affected Versions cluster-curator-controller affected versions not specified Description A flaw in the cluster-curator-controller component allows a local user to escalate privileges from namespace-local access to cluster-wide control. By creating a...
CVE-2026-72526: Unintended Proxy or Intermediary
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...
The vulnerability of the drivers/pci/controller/cadence components in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the drivers/pci/controller/cadence components in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability in the driver/mtd/nand/raw/cadence-nand-controller.c component of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the drivers/mtd/nand/raw/cadence-nand-controller.c component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
