CVE-2024-52317

🚨🚨CVE-2024-52317🚨🚨 CVE-2024-52317 - Apache Tomcat HTTP/2 Data Leakage Vulnerability Overview CVE-2024-52317 is a vulnerability affecting Apache Tomcat's HTTP/2 implementation. The issue arises due to improper recycling of HTTP/2 request and response resources, potentially leading to data leakage...

CVE-2026-33555

HTTP Request Smuggling via HAProxy H3/QUIC Standalone FIN Body Validation Bypass Full post here : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Summary A vulnerability in HAProxy's HTTP/3 implementation allows an attacker to send an HTTP request with a...

RLSA-2026:98559 Moderate: sssd security, bug fix, and enhancement update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

sssd security, bug fix, and enhancement update

An update is available for sssd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The System Security Services Daemon SSSD service provides a set of daemons to...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

CVE-2025-46818

CVE-2025-46818 – Redis Lua Sandbox Cross-User Escape Sandbox escape via deprecated Lua APIs and mutable metatables on Redis 8.2.1. Overview Redis 8.2.1 keeps deprecated Lua builtins getfenv, setfenv, newproxy exposed to scripts and fails to lock metatables for basic types. An attacker can inject...

Moderate: Red Hat Security Advisory: sssd security, bug fix, and enhancement update

An update for sssd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

sssd: sssd: IdP authentication prefix comparison allows cross-user impersonation

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

RHEL 10 : sssd (RHSA-2026:98559)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:98559 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It...

GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

Impact An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy. The clusterapiserverproxy handler did not perform a resource-level authorization check before forwarding requests to the selected cluster...

GHSA-3HCH-X692-6QJ3 GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

Impact An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy. The clusterapiserverproxy handler did not perform a resource-level authorization check before forwarding requests to the selected cluster...

FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

Summary POST /upload uses the request-supplied resumableFilename directly as a key into the shared temporary directory, without the character filter it applies to resumableIdentifier and without namespacing it per user. A valid user holding the upload permission can read any file in that director...

GHSA-44R8-3P76-84MW FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

Summary POST /upload uses the request-supplied resumableFilename directly as a key into the shared temporary directory, without the character filter it applies to resumableIdentifier and without namespacing it per user. A valid user holding the upload permission can read any file in that director...

GHSA-F74M-X83R-C4V4 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

Summary GET /batchdownload streams a batch ZIP to any requester who supplies its uniqid, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user's...

FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

Summary GET /batchdownload streams a batch ZIP to any requester who supplies its uniqid, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user's...

CVE-2026-120474

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final response stored under the original...

Linux Distros Unpatched Vulnerability : CVE-2026-120474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are...

CVE-2026-94619 FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...

CVE-2026-94619 FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...

CVE-2026-94619 FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...