CVE-2026-3288

creationtimestamp| type| source ---|---|--- 2026-03-10 14:35:26+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/kubernetes-security-advisory-av26-208 2026-03-10 16:00:36+00:00| seen| https://gist.github.com/ichintu/18b9a09140a4dbb6aab50fdd24d38fb4 2026-03-17 15:07:42+00:00| seen|...

Windows Kernel Elevation of Privilege Vulnerability

External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, skopeo, terraform-provider-sendgrid, tfsec, kubernetes-event-exporter, kubernetes, otel-cli, kubernetes-csi-external-snapshotter, prometheus-adapter, argocd-image-updater, crossplane-provider-aws-firehose, oauth2-proxy, cass-operator,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, oras, cass-operator, atlantis, nsc, rancher-agent, sftpgo-plugin-auth, victoriametrics-operator, flux-image-reflector-controller, pvc-autoresizer, aws-s3-controller, swagger, q, influx, pguser, kyverno-policy-reporter-kyverno-plugin,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, oras, cass-operator, atlantis, nsc, rancher-agent, sftpgo-plugin-auth, victoriametrics-operator, flux-image-reflector-controller, pvc-autoresizer, aws-s3-controller, swagger, q, influx, pguser, kyverno-policy-reporter-kyverno-plugin,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: prometheus-operator, spiffe-helper, thanos, kube-state-metrics, apm-server-fips, kpt, nvidia-container-toolkit, k6-fips, gitaly, crossplane-provider-aws-memorydb, tigera-operator, crossplane-function-go-templating, cass-operator, kubernetes-dashboard-api-fips,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: nri-redis, prometheus-operator, spiffe-helper, thanos, aws-load-balancer-controller-fips, kube-state-metrics, apm-server-fips, kpt, nri-consul-fips, regclient-fips, nvidia-container-toolkit, supercronic, vale, k6-fips, gitaly,...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

DEBIAN-CVE-2026-31802

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar npm can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x...

firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software...

RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

Impact Vulnerability Type: Improper Control of Generation of Code 'Code Injection' CWE-94 / Improper Check for Unusual or Exceptional Conditions CWE-754 / Improper Input Validation CWE-20 / Use of Low-Level Functionality CWE-695 / Improper Privilege Management CWE-269 / External Control of System...

Malicious code in xc-input-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bd6a138ac384a0c310614cf8a679db9c7c02f9b4b44fbfb98910514eb2e80e The package xc-input-toggle was found to contain malicious code. Source: ghsa-malware aa8d4ebd389bd00b1f92bc14e6d9e1a2ffc83e2ef239991e0e01c0bb445166c...

SUSE CVE-2026-28348

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.4, the hassneakyjavascript method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression filters,...

CVE-2026-24316 Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery SSRF. Successful exploitation could lead to interaction with...

CVE-2026-24316 Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery SSRF. Successful exploitation could lead to interaction with...

CVE-2026-24316

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery SSRF. Successful exploitation could lead to interaction with...

PT-2026-24281

External control of file name or path in Windows Kernel allows an authorized attacker to elevate privileges locally...

Fortinet FortiManager Format string vulnerability in fazsvcd (FG-IR-26-092)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-092 advisory. - A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer...

PT-2026-24158

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP affected versions not specified Description The software includes an ABAP Report designed for testing that enables sending HTTP requests to any internal or external endpoint. This functionality is...

PT-2026-24338

Name of the Vulnerable Software and Affected Versions Azure Entra ID affected versions not specified Description An issue exists in Azure Entra ID where external initialization of trusted variables or data stores can allow an unauthorized attacker to elevate privileges locally. Recommendations At...