CVE-2026-92768

CVE-2026-92768 affects cockpit-machines , a component of the Cockpit web-based server management tool. The root cause is that password values are passed directly as command-line arguments during VM creation or installation, making them visible to other local users on systems where process argumen...

CVE-2026-92747

A flaw in cockpit-machines allows a local attacker who can inspect running processes to read sensitive guest VM credentials (rootPassword , userPassword ) exposed on the command line. The root cause is the install_machine.py script passing these credentials as a JSON command-line argument during ...

CVE-2026-81178

SysReptor , a customizable pentest reporting platform, is affected by an information disclosure vulnerability prior to 2026.55 . An unauthenticated holder of a public note share link is placed in the same collaboration group as authenticated project members, causing the application to forward cli...

CVE-2026-81178 SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and...

CVE-2026-59982

A flaw was found in OpenEXR. A remote attacker could provide a specially crafted deep EXR image file, which, when processed by a user, could lead to an out-of-bounds pointer being returned by the TypedDeepImageChannel::row function. This vulnerability could cause the application to crash Denial o...

CVE-2026-59189

A flaw was found in OpenEXR. An attacker could provide a specially crafted deep image that, when processed, would cause an out-of-bounds read in the TypedDeepImageChannel::row API if the image has a non-zero dataWindow origin. This vulnerability can lead to a heap out-of-bounds read, resulting in...

CVE-2026-92768

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password value...

CVE-2026-92745

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management RHSM offline token. The token is exposed when it is passed as a command-line argument to a helper script during the...

CVE-2026-92747

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine VM credentials, such as rootPassword and userPassword. This occurs when the installmachine.py script passes these credentials as...

CVE-2026-91202

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

CVE-2026-91203

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

CVE-2025-53837

creationtimestamp| type| source ---|---|--- 2026-09-18 16:31:38+00:00| seen| https://gist.github.com/alon710/167c49d842b30884b7c5e7737ec5f46c 2026-09-18 18:07:42+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvsr5gnh3a2g 2026-09-18 20:50:07+00:00| seen|...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jaeger: jaeger-2.20.0-0.9.hum1 aarch64, x8664 jaeger-2.20.0-0.9.hum1.src src Security Fixes: jaeger: CVE-2026-81871...

CVE-2026-93604

creationtimestamp| type| source ---|---|--- 2026-09-18 16:17:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/h73hl4fhqsool...

CVE-2026-11537 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

CVE-2026-84398

CareCam CM2507 IP cameras are vulnerable to unauthorized access due to an empty password accepted for a privileged account exposed through the ONVIF management service. The root cause is an empty password stored in a configuration file, allowing an attacker with network access to reach privileged...

CVE-2023-5778

creationtimestamp| type| source ---|---|--- 2026-09-18 16:07:22+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvskgav34n2j 2026-09-18 20:15:04+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/control-systems-abb-security-advisory-av26-942 2026-09-18 20:40:05+00:00| seen|...

CVE-2026-13348

creationtimestamp| type| source ---|---|--- 2026-09-18 16:06:04+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mvskdwixlo2n 2026-09-19 10:10:43+00:00| seen| https://bsky.app/profile/elena.gworky.com/post/3mvugxgjrki2t 2026-09-19 10:10:43+00:00| seen|...

CVE-2025-36421 Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-33141 IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment...