Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.12.1 security update

This is an updated version of the Node Health Check Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Node Health Check Operator deploys the Node Health Check controller. The controller identifies unhealthy nodes and uses a remediation provider to remediate the...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.7.1 security update

This is an updated version of the Machine Deletion Remediation Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Machine Deletion Remediation MDR Operator works with the Node Health Check NHC Operator to reprovision unhealthy nodes using the Machine API. The MDR...

CVE-2026-17596

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2026-17596

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2026-17596 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2026-17596 Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

CVE-2026-17596

CVE-2026-17596 affects Nexus Repository 3. A stored XSS issue arises when a user with nexus:blobstores:create or nexus:blobstores:update can set a blob store name containing malicious script, which then executes in other users’ browsers when viewing system health-check status. Root cause: unsafe ...

CVE-2026-17596

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

PT-2026-69058

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 versions prior to 3.95.0 Description Stored cross-site scripting XSS occurs when a user with nexus:blobstores:create or nexus:blobstores:update permissions sets a blob store name containing malicious script content. This...

VMware vSphere Client (HTML5) - Remote Code Execution Detection

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

PYSEC-2026-3513 praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is set Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Version tested: 4.6.48...

Malicious code in system-health-check-test-unique (PyPI)

Source: kam193 10bfd6e986187675dd7d7e3a8f860807e408fd6a91694ca0e0128be83fa8fc47 Importing the module exfiltrates content of /var/www/html to a remote host --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-system-health-check-test-unique...

PT-2026-62010

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script extracts uploaded archives without imposing limits on the number of entries, directory depth, total entries, or output size. An attacker can use a small malicious archive...

CVE-2026-57206

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/singleapp/pluginvalidationendpoint.py, including "POST /api/admin/plugins/test-instantiation", "GET...

CVE-2026-57206

CVE-2026-57206 affects SimpleChat prior to version 0.241.206, where multiple plugin validation endpoints in application/single_app/plugin_validation_endpoint.py—specifically POST /api/admin/plugins/test-instantiation, GET /api/admin/plugins/health-check/, POST /api/admin/plugins/repair/, and POST...

CVE-2026-57206 SimpleChat plugin validation endpoints missing authentication and authorization

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/singleapp/pluginvalidationendpoint.py, including POST /api/admin/plugins/test-instantiation, GET...

CVE-2026-57206

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/singleapp/pluginvalidationendpoint.py, including POST /api/admin/plugins/test-instantiation, GET...

PT-2026-60488

Name of the Vulnerable Software and Affected Versions SimpleChat versions prior to 0.241.206 Description Several plugin validation routes in application/single app/plugin validation endpoint.py failed to enforce runtime authentication and authorization checks. While the documentation indicated...

PYSEC-2026-2956 Prefect Auth Bypass via endswith() Health Check Exemption

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...

Prefect Auth Bypass via endswith() Health Check Exemption

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...