Linux Distros Unpatched Vulnerability : CVE-2026-68519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for...

CVE-2026-66792

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

CVE-2026-68519

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

CVE-2026-68519

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

CVE-2026-66792 Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

CVE-2026-66792

multicloud-operators-subscription (Red Hat Advanced Cluster Management) trusts user-settable annotations to determine cluster-admin status. A managed-cluster user can create a Subscription with crafted annotations to trigger isclusteradmin() as true, escalating to deploy resources anywhere using ...

CVE-2026-66792

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

EUVD-2026-60322

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

CVE-2026-66792 Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

CVE-2026-66792

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

CVE-2026-68519 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

CVE-2026-68519

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

CVE-2026-68519

In Glances before 4.5.6, GlancesActions.run() in glances/actions.py bypasses the --disable-config-exec flag for on-alert action commands, invoking secure_popen() with shell operators enabled. This permits configured redirection, command chaining, or pipes to execute when an alert triggers, posing...

CVE-2026-68519 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

CVE-2026-68519 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

CVE-2026-66792: Incorrect Authorization

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

PT-2026-76752

Name of the Vulnerable Software and Affected Versions multicloud-operators-subscription affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a user on a managed cluster to escalate privileges. By creating a Subscription with specifically...

CVE-2026-74789 Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations

Scriban before 7.0.0 affected = 6.6.0 applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as 1..1000000 | array.size — or a memory-amplification expression such as '...

PT-2026-73157

Scriban before 7.0.0 affected = 6.6.0 applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as 1..1000000 | array.size — or a memory-amplification expression such as '...