EUVD-2026-60205

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

CVE-2026-71566

FakeFish passes credentials to scripts for real hardware BMC validation, but the KubeVirt backend ignores them entirely, relying on a mounted KUBECONFIG file. This lets any cluster user control, power-cycle, and attach arbitrary CD images to VMs owned by other users. CVSS 9.3 (Critical). No patch...

CVE-2026-71566

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

CVE-2026-71566 KubeVirt backend is not authenticated

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

EUVD-2026-59996

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...

PT-2026-76666

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

CVE-2026-71566: Missing Authentication for Critical Function

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

CVE-2026-19958

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-19958

The CVE concerns iatsiuk pptr-mcp up to 0.2.7. Affected component is the execute Tool’s file src/vm-executor.ts, function executeCode, where manipulation enables code injection. Impact is exposed via a remote attack with public exploit availability; CVSS data indicates MEDIUM severity with networ...

CVE-2026-19958 iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-19958 iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-19958 iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-19958: Improper Control of Generation of Code

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...

EUVD-2026-59772

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

UBUNTU-CVE-2026-72286

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as...

CVE-2026-72286 KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as...

EUVD-2026-59184

In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVMTDXINITVM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdxtdinit first reads userdata-cpuid.nent to...

PT-2026-72976

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove remove pud mapping and remove p4d mapping obtain a child table base with pud offsetp4dp, 0 and p4d offsetpgd, 0, then add the index for addr. RISC-V folds...

PT-2026-72856

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VM IO or VM PFNMAP when creating SVM ranges VMAs marked with VM IO or VM PFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, get pages...

PT-2026-72282

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free in amdxdna gem dmabuf mmap When vm insert pages fails, the error path calls vma-vm ops-closevma which internally calls drm gem vm close → drm gem object put, releasing the GEM object reference...