CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50236

The CVE-2026-50236 issue affects OpenShift OpenShift Console Dev Console webhook helpers, where authenticated users can trigger SSRF by supplying target URLs that are fetched server-side without validation. The underlying flaw enables path neutralization that can target arbitrary endpoints and re...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching

A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...

CVE-2026-73155

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

wifi: wilc1000: validate assoc response length before subtracting header

...

hwmon: occ: validate poll response sensor blocks

...

IB/mad: Drop unmatched RMPP responses before reassembly

...

SUSE CVE-2026-30246

Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key...

PT-2026-80494

Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer allocated for the Modbus response if the function tries to reply to a Modbus request with an unexpected length...

CVE-2026-15556: Improper Verification of Cryptographic Signature

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...

CVE-2026-50236: Server-Side Request Forgery (SSRF)

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

Fedora 43 : nghttp2 (2026-91dd0c29d6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-91dd0c29d6 advisory. - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the preceding...

PT-2026-70151

Name of the Vulnerable Software and Affected Versions OpenShift Console affected versions not specified Description An authenticated Server-Side Request Forgery SSRF flaw exists in the OpenShift Console Dev Console webhook helpers. The system fetches user-supplied target URLs server-side without...

CVE-2026-10579: Improper Verification of Cryptographic Signature

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...

PT-2026-70090

Name of the Vulnerable Software and Affected Versions Picketlink affected versions not specified Description A flaw exists in the Service Provider SP signature validation. An attacker can forge a SAML response containing zero assertion elements that match the signature check, enabling them to...

CVE-2026-71966

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

EUVD-2026-55736

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

CVE-2026-71966

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

CVE-2026-71966 CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...