CVE-2026-52942

In the Linux kernel, the following vulnerability has been resolved: netfilter: nflog: validate MAC header was set before dumping it The fallback path of dumpmacheader guards the MAC header access only with "skb-macheader != skb-networkheader", without checking skbmacheaderwasset. When the MAC...

EUVD-2026-38711

In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn-lnk in smcmsgevent tracepoint The smcmsgevent tracepoint class, shared by smctxsendmsg and smcrxrecvmsg, unconditionally dereferences smc-conn.lnk: stringname, smc-conn.lnk-ibname conn-lnk is onl...

CVE-2026-9073

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug...

CVE-2026-11820 Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query string

A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding API credentials apikey and apisecret into URL query parameters and sending them via GET requests. This causes credentials to be exposed in web...

CVE-2026-9073

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug...

CVE-2026-9073

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug...

CVE-2026-12112

CVE-2026-12112 affects the foreman-mcp-server MCP Server. The issue is a session management vulnerability where an improper cache of authenticated client connections allows an unauthenticated attacker to hijack active administrative sessions by trusting a non-secret session ID without re-validati...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609 Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

EUVD-2026-38448

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

The vulnerability CVE-2026-10609 affects the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, enabling a delegated editor to exfiltrate...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, kube-logging-operator, logstash, ruby3.2-rails, logstash-fips, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, gitlab-rails-ce...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, kube-logging-operator, logstash, ruby3.2-rails, logstash-fips, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, gitlab-rails-ce...

GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, kube-logging-operator, logstash, ruby3.2-rails, logstash-fips, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, gitlab-rails-ce...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, kube-logging-operator, logstash, ruby3.2-rails, logstash-fips, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, gitlab-rails-ce...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, kube-logging-operator, logstash, ruby3.2-rails, logstash-fips, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, gitlab-rails-ce...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, kube-logging-operator, logstash, ruby3.2-rails, logstash-fips, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, gitlab-rails-ce...

GHSA-P67V-3W7G-WJG7 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, ruby4.0-rails, kube-logging-operator, logstash, ruby3.2-rails, logstash-fips, ruby3.4-rails, pact-broker-docker, pact-broker-docker-fips, gitlab-rails-ce...