PT-2026-76752

Name of the Vulnerable Software and Affected Versions multicloud-operators-subscription affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a user on a managed cluster to escalate privileges. By creating a Subscription with specifically...

CVE-2026-74462

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: mark I2C adapter when hardware is powered down On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers. During system suspend/resume, there exists a time...

EUVD-2026-59305

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevice, including the DMA block, MMIO mapping, PCI regions, and the...

CVE-2026-72205 ntfs: free volume-wide resources on fill_super failure

In the Linux kernel, the following vulnerability has been resolved: ntfs: free volume-wide resources on fillsuper failure ntfsfillsuper's erroutnow path frees only the volume struct via kfreevol, leaving several vol-owned allocations behind on every mount failure: - vol-nlsmap, loaded by...

PT-2026-72594

In the Linux kernel, the following vulnerability has been resolved: net: sungem: fix probe error cleanup gem init one calls gem remove one when register netdev fails. gem remove one unregisters and frees resources owned by the net device, including the DMA block, MMIO mapping, PCI regions, and th...

CVE-2026-19871 Use of hard-coded credentials in Prospero Flow CRM employee onboarding

Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back t...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

The vulnerability in the base/regmap/regmap.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the base/regmap/regmap.c component of the Linux operating system is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the `net/mptcp/pm_kernel.c` component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the net/mptcp/pmkernel.c component of the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the net/ipv6/ndisc.c component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the net/ipv6/ndisc.c component of the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-72741

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterpris...

ROS-20260813-73-0032

The vulnerability in Gitea relates to the failure to release resources after their useful life has ended. Exploiting this vulnerability allows a malicious actor to cause service failures through specially created IPv6 traffic...

The vulnerability of the f2fs component of the Linux operating system’s kernel, which allows a hacker to cause a service failure

The vulnerability of the f2fs component of the Linux operating system’s kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-72508

The CVE-2026-72508 issue affects the multicloud-operators-subscription component in Red Hat Advanced Cluster Management (RHACM). A namespace-admin tenant can perform a confused‑deputy attack by creating Subscription Custom Resources that leverage a highly privileged ServiceAccount, enabling deplo...

CVE-2026-72508 Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

CVE-2026-72508

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters

A flaw was found in Quarkus. A remote attacker could bypass HTTP path-based authorization policies by using specially crafted encoded semicolons, slashes, or backslashes in HTTP requests. This could allow unauthorized access to protected static resources, leading to information disclosure...

EUVD-2026-57388

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

SUSE CVE-2026-59090

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...

PT-2026-71287

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a namespace-admin tenant to execute a confused-deputy attack. By creating Subscription Custom...