GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: glab, minio, step-issuer, trivy, aactl, gh, falcoctl, crossplane-provider-family-azure, k9s, fulcio, mattermost, prometheus-operator, trivy-operator, zot, k3s, gitea, cert-manager, kyverno, pulumi-language-java, flux-kustomize-controller, cilium-cli, knative-serving,...

CVE-2026-13322

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine, which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the...

CVE-2026-0068

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution...

CVE-2026-0068

In Android, CVE-2026-0068 affects PackageInstallerService.java (createSessionInternal). The vulnerability enables a local attacker to remove a DPC app from a managed device without DO consent due to persistence desync, potentially causing local elevation of privilege if a malicious app is install...

CVE-2026-0068

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution...

PT-2026-50231

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution...

CVE-2026-0055

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller DPC into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

EUVD-2026-33782

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller DPC into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

CVE-2026-0055

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller DPC into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

CVE-2026-0055

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller DPC into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

CVE-2026-0055

CVE-2026-0055 describes a path traversal in PackageInstallerService.java (createSessionInternal) that could let an attacker place or move a Device Policy Controller (DPC) into an invalid directory, enabling local privilege escalation without extra execution privileges or user interaction. The det...

CVE-2026-0055

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller DPC into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

ASB-A-460779368

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller DPC into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

PT-2026-45576

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A path traversal error exists in the createSessionInternal function of the PackageInstallerService.java class within the Framework component. This flaw allows a local attacker to update a...

CLEANSTART-2026-YQ26872 Security fixes for CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2026-1229, CVE-2026-24051, CVE-2026-34986, CVE-2026-39984, ghsa-78h2-9frx-2jm8, ghsa-pmwq-pjrm-6p5r, ghsa-xm5m-wgh2-rrg3 applied in versions: 0.13.1-r0, 0.15.1-r0

Multiple security vulnerabilities affect the policy-controller-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FA95643 Security fixes for CVE-2026-33814, CVE-2026-34986, CVE-2026-39883, CVE-2026-39984, ghsa-pmwq-pjrm-6p5r applied in versions: 0.15.1-r0

Multiple security vulnerabilities affect the policy-controller package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: docker-compose, dagger, cosign, trivy, aactl, gh, docker-cli-buildx, spire-server, falcoctl, ratify, bom, rekor, gitsign, trivy-operator, zot, tkn, goreleaser, kyverno, gitlab-runner, teleport, vexctl, tflint, crossplane, tekton-chains, slsa-verifier,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: reports-server, gitlab-runner, tkn, kubescape-server, cosign-fips, falcoctl-fips, docker-compose-fips, vexctl, tekton-chains-fips, trivy, cg, kubescape-server-fips, crossplane-fips, flux-source-controller, kyverno-policy-reporter-plugins-kyverno, zarf, kyverno,...

Cisco APIC Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

According to its self-reported version, Cisco Application Policy Infrastructure Controller is affected by a vulnerability. - A remote code execution vulnerability exists in Cisco Application Policy Infrastructure Controller due to a signal handler race condition found in sshd, where a client does...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: cosign, trivy, aactl, gh, docker-cli-buildx, spire-server, falcoctl, ratify, sigstore-scaffolding, gitsign, trivy-operator, zot, tkn, goreleaser, kyverno, teleport, vexctl, tflint, crossplane, tekton-chains, slsa-verifier, neuvector-sigstore-interface, zarf, kubescap...