GHSA-495J-H493-42Q2 Strapi Allows Unauthorized Access to Private Fields via parms.lookup

Summary It's possible to access any private fields by filtering through the lookup parameters Details Using the new lookup operator provided by the document service in Strapi 5, it is not properly sanitizing this query operator for private fields. PoC 1. Create a strapi app. 2. Create a...

Strapi Allows Unauthorized Access to Private Fields via parms.lookup

Summary It's possible to access any private fields by filtering through the lookup parameters Details Using the new lookup operator provided by the document service in Strapi 5, it is not properly sanitizing this query operator for private fields. PoC 1. Create a strapi app. 2. Create a...

Authorization Bypass Through User-Controlled Key

Overview @strapi/core is a Core of Strapi Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the lookup operator in the document service due to improper sanitization of query operator for private fields . An attacker can retrieve sensitive...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.16 Images Update

New images are available for Red Hat build of Keycloak 26.0.16 and Red Hat build of Keycloak 26.0.16 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2025-32988 DESCRIPTION: A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject...

CVE-2025-26861

RemoteCall Remote Support Program for Operator versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...

CVE-2025-26860

RemoteCall Remote Support Program for Operator versions prior to 5.1.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...

CVE-2024-56143: Authorization Bypass Through User-Controlled Key

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset...

CVE-2025-62382

CVE-2025-62382 affects Frigate (network video recorder for IP cameras). Before v0.16.2, the export workflow lets an authenticated operator nominate any filesystem path as the thumbnail source for a video export. The chosen path is copied verbatim into the publicly served clips directory, enabling...

CVE-2025-61780 vulnerabilities

Vulnerabilities for packages: ruby3.2-rack, ruby3.3-rack, ruby3.4-rack, kube-fluentd-operator, ruby4.0-rack...

GHSA-R657-RXJC-J557 vulnerabilities

Vulnerabilities for packages: ruby3.2-rack, ruby3.3-rack, ruby3.4-rack, kube-fluentd-operator, ruby4.0-rack...

GHSA-6XW4-3V39-52MM vulnerabilities

Vulnerabilities for packages: ruby3.2-rack, ruby3.3-rack, ruby3.4-rack, kube-fluentd-operator, ruby4.0-rack...

CVE-2025-61919 vulnerabilities

Vulnerabilities for packages: ruby3.2-rack, ruby3.3-rack, ruby3.4-rack, kube-fluentd-operator, ruby4.0-rack...

CVE-2025-61919 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, ruby3.4-rack, ruby3.4-rails, ruby3.3-rails, ruby3.2-rack, logstash, ruby3.3-rack, kube-fluentd-operator, ruby3.2-rails, ruby4.0-rack...

GHSA-6XW4-3V39-52MM vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, ruby3.4-rack, ruby3.4-rails, ruby3.3-rails, ruby3.2-rack, logstash, ruby3.3-rack, kube-fluentd-operator, ruby3.2-rails, ruby4.0-rack...

GHSA-R657-RXJC-J557 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, ruby3.4-rack, ruby3.4-rails, ruby3.3-rails, ruby3.2-rack, logstash, ruby3.3-rack, kube-fluentd-operator, ruby3.2-rails, ruby4.0-rack...

CVE-2025-61780 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, ruby3.4-rack, ruby3.4-rails, ruby3.3-rails, ruby3.2-rack, logstash, ruby3.3-rack, kube-fluentd-operator, ruby3.2-rails, ruby4.0-rack...

EUVD-2025-34516

RemoteCall Remote Support Program for Operator versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...

CVE-2025-26861

RemoteCall Remote Support Program for Operator versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...

CVE-2025-26861

RemoteCall Remote Support Program for Operator versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution...