CVE-2026-10101

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions.message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's...

RLSA-2026:19054 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 For more details about the security issues, including the impact, a CVSS...

tomcat security update

An update is available for tomcat. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Apache Tomcat is a servlet container for the Java Servlet and JavaServer Page...

CVE-2026-10101

The CVE-2026-10101 issue affects the OpenShift ACM/MCE assisted-service: pull-secret validation failures cause raw referenced pull-secret content to be written into InfraEnv.status.conditions[].message. A namespace viewer with only the view ClusterRole can read InfraEnv objects and reconstruct th...

EUVD-2026-33342

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions.message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's...

CVE-2026-10101 Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions.message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's...

CVE-2026-10101 Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions.message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's...

CVE-2026-10101

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions.message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's...

CVE-2026-10101

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions.message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's...

CVE-2026-9558

creationtimestamp| type| source ---|---|--- 2026-05-29 12:05:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmyio2hges2e 2026-05-31 01:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mn4ehkhlmf2h 2026-07-03 21:52:04+00:00| seen|...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the InfraEnv.status.conditions.message process. An attacker can access sensitive credential information by reading the status of InfraEnv objects when a referenced pull secret fails...

CVE-2026-3655

creationtimestamp| type| source ---|---|--- 2026-05-29 09:00:41+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mmy6e4lrqw2y 2026-05-29 09:00:51+00:00| seen| https://infosec.exchange/users/offseq/statuses/116657044700520372 2026-05-29 09:49:06+00:00| seen|...

usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl

...

CVE-2026-49215

creationtimestamp| type| source ---|---|--- 2026-05-29 07:32:39+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmxzgqhaiq2p...

CVE-2026-46114

creationtimestamp| type| source ---|---|--- 2026-05-29 03:43:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116655797964744274 2026-07-09 01:19:34+00:00| seen| https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities20260702...

Linux Distros Unpatched Vulnerability : CVE-2026-10001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-9960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code...

SUSE SLES12 Security Update : xen (SUSE-SU-2026:2066-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2066-1 advisory. This update for xen fixes the following issues - CVE-2025-54505: Floating Point Divider State Sampling on AMD CPUs AMD-SN-7053 bsc1262428. -...

PT-2026-44952

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2026.1 JetBrains TeamCity version 2025.11.5 Description An unauthenticated Server-Side Request Forgery SSRF is possible via the build status. SSRF is a flaw that allows an attacker to induce the server-side...

PT-2026-44890

Name of the Vulnerable Software and Affected Versions ACM/MCE assisted-service affected versions not specified Description The assisted-service writes raw referenced pull-secret contents into the InfraEnv.status.conditions.message field when pull-secret validation fails. This allows a namespace...