CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-22622

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device...

CVE-2026-22621

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment...

CVE-2026-22622

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device...

CVE-2026-22622

Summary: CVE-2026-22622 affects Eaton’s Tripp Lite series PADM firmware. An authenticated user can exploit improper input validation in a session management interface to elevate privileges, potentially gaining unrestricted device access. The CVSSv3.1 base score is 8.8 (HIGH) with network attack v...

EUVD-2026-51077

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device...

CVE-2026-22622

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device...

CVE-2026-22622

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device...

EUVD-2026-51076

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment...

CVE-2026-22621

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment...

CVE-2026-22621

Technical details about CVE-2026-22621 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2026-22621

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment...

CVE-2026-22621

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment...

CVE-2026-64476

A flaw was found in the Linux kernel's vfio/pci driver. The disableidled3 flag, which controls device power states, was handled as a global module parameter instead of being latched per device. This improper handling could lead to unbalanced Power Management PM operations for devices already boun...

CLEANSTART-2026-IW72112 Security fixes in management-api-for-apache-cassandra-5.0 0.1.118-r2

Package management-api-for-apache-cassandra-5.0 version 0.1.118-r2 fixes 26 vulnerabilities: CVE-2026-42583, CVE-2026-42579, CVE-2026-33870, CVE-2026-42584, CVE-2026-42587...

CLEANSTART-2026-BX90516 Security fixes in cert-manager-cmctl-fips 2.4.0-r3

Package cert-manager-cmctl-fips version 2.4.0-r3 fixes 30 vulnerabilities: CVE-2026-27143, CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-32281...

CVE-2026-7849 Command Injection in SCM (idledisconnect parameter)

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root...

CVE-2026-7849

CVE-2026-7849: Concrete details across connected documents show a command-injection vulnerability in SCM (idledisconnect parameter) that allows an unauthenticated remote attacker to inject a command into system configuration, which is then executed with root privileges. Impact is high (confidenti...

CVE-2026-15153

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...