298398 matches found
EUVD-2026-51097
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...
CVE-2026-59310
VMware vCenter Server is affected by CVE-2026-59310: a directory traversal in the Syslog server that allows arbitrary code execution if an attacker has network access. CVSSv3.1 base score 9.8 (critical, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Remediation is via patched versions listed in Broadcom’s...
RLSA-2026:47755 Moderate: openssh security update
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux...
CVE-2026-18378 Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...
CVE-2026-18369
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
ROOT-APP-NPM-CVE-2026-6402 CVE-2026-6402 in @rootio/webpack-dev-server - Patched by Root
Root has patched CVE-2026-6402 in the @rootio/webpack-dev-server package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-9595 CVE-2026-9595 in @rootio/webpack-dev-server - Patched by Root
Root has patched CVE-2026-9595 in the @rootio/webpack-dev-server package for Root:npm. Multiple fixed versions available...
Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)
Overview On July 29, 2026, Broadcom published security advisory VMSA-2026-0006 addressing multiple vulnerabilities in several VMWare products. Included in the advisory are two critical remotely exploitable vulnerabilities affecting VMware vCenter Server: CVE-2026-59309 and CVE-2026-59310. Both...
CVE-2026-18369 Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
CVE-2026-18369
Dogtag PKI’s ACME responder is vulnerable: the HTTP-01 validator accepts IP literal identifiers and follows redirects without validating public-facing targets, enabling unauthenticated ACME accounts to induce SSRF to internal services. With the InMemory database backend, the internal target respo...
EUVD-2026-51078
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure
A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery SSRF, where the server is coerced into making requests to...
CVE-2026-44092
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...
CLEANSTART-2026-KD56699 Security fixes in metrics-server-fips 0.8.0-r5
Package metrics-server-fips version 0.8.0-r5 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...
CLEANSTART-2026-IU37943 Security fixes in cloud-config-server 4.3.2-r3
Package cloud-config-server version 4.3.2-r3 fixes 38 vulnerabilities: CVE-2026-33870, CVE-2026-33871, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587...
CLEANSTART-2026-ZU57657 Security fixes in temporal-server 1.31.0.153.1-r0
Package temporal-server version 1.31.0.153.1-r0 fixes 35 vulnerabilities: CVE-2026-41602, CVE-2026-42502, CVE-2026-42504, CVE-2026-42505, CVE-2026-42506...
CLEANSTART-2026-AA71310 Security fixes in spire-server-fips 1.14.5-r0
Package spire-server-fips version 1.14.5-r0 fixes 3 vulnerabilities: CVE-2026-33816, ghsa-xmrv-pmrh-hhx2, CVE-2026-34986...
CLEANSTART-2026-BQ82502 Security fixes in temporal-ui-server-fips 2.44.0-r0
Package temporal-ui-server-fips version 2.44.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...
CLEANSTART-2026-YS49357 Security fixes in cloud-config-server 4.3.2-r2
Package cloud-config-server version 4.3.2-r2 fixes 15 vulnerabilities: CVE-2026-41293, CVE-2026-43512, CVE-2026-43515, CVE-2026-41284, CVE-2026-42498...