openstack-keystone: OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw

A flaw was found in OpenStack Keystone. This vulnerability allows an attacker to obtain a valid OpenStack's Keystone token, leading to access to unauthorized resources or privilege escalation within the OpenStack instance via sending a valid AWS Amazon Web Services signature to the /v3/ec2tokens ...

RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) (RHSA-2026:1958)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:1958 advisory. Keystone is a Python implementation of the OpenStack http://www.openstack.org identity service API. Security Fixes: OpenStack Keystone: Unauthorized...

CVE-2024-26477

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazonsns, export endpoints...

CVE-2024-26477

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazonsns, export endpoints...

Rewiring Democracy Ebook is on Sale

I just noticed that the ebook version of Rewiring Democracy is on sale for $5 on Amazon, Apple Books, Barnes & Noble, Books A Million, Google Play, Kobo, and presumably everywhere else in the US. I have no idea how long this will last. Also, Amazon has a coupon that brings the hardcover price dow...

[SECURITY] Fedora 42 Update: rust-eif_build-0.2.1-6.fc42

This CLI tool provides a low level path to assemble an enclave image format EIF file used in AWS Nitro Enclaves...

statping-ng 安全漏洞

Statping-ng is an open-source server monitoring software developed by Statping-ng. Version 0.91.0 of Statping-ng contains a security vulnerability. This vulnerability stems from improper handling of specially crafted requests for endpoint API parameters such as oauth, amazonsns, and export, which...

CVE-2024-26477

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazonsns, export endpoints...

PT-2026-7651

Name of the Vulnerable Software and Affected Versions Statping-ng version 0.91.0 Description An issue allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazon sns, and export API endpoints. Recommendations Apply updates to address the issu...

Git Eclipse JGit XXE

The vulnerability of the ManifestParser and AmazonS3 classes in the Git version control system, implemented in the Java Eclipse JGit framework, is related to an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attack...

CVE-2024-26477

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazonsns, export endpoints...

CVE-2024-26477

An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazonsns, export endpoints...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: rancher-fleet, flux-image-automation-controller-fips, flux-kustomize-controller-fips, amazon-ssm-agent, src-fingerprint, scorecard, grafana, zarf, gitlab-runner, kots, tfsec, grafana-alloy, argo-workflows, argocd-image-updater, pulumi-language-java, timoni, chezmoi,...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: rancher-fleet, flux-image-automation-controller-fips, flux-kustomize-controller-fips, amazon-ssm-agent, src-fingerprint, scorecard, grafana, zarf, gitlab-runner, kots, tfsec, grafana-alloy, argo-workflows, argocd-image-updater, pulumi-language-java, timoni, chezmoi,...

GHSA-H355-32PF-P2XM vulnerabilities

Vulnerabilities for packages: prometheus-adapter, podinfo, glow, xeol, nginx-prometheus-exporter, opa-envoy, fuse-overlayfs-snapshotter, helm, cortex, blob-csi, kubernetes-dashboard-web, mailpit, crossplane-provider-family-aws, paranoia, nova, kubebuilder, kube-fluentd-operator,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: chart-testing, crossplane-function-go-templating-fips, kvm-device-plugin, yace, crossplane-provider-family-aws-fips, src-fingerprint, crossplane-provider-kubernetes-fips, amass, gendesk, kubernetes-dashboard-api, longhorn-backing-image-manager-fips, quic-go-fips,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: chart-testing, crossplane-function-go-templating-fips, kvm-device-plugin, crossplane-provider-family-aws-fips, src-fingerprint, crossplane-provider-kubernetes-fips, amass, gendesk, kubernetes-dashboard-api, longhorn-backing-image-manager-fips, quic-go-fips,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: chart-testing, crossplane-function-go-templating-fips, kvm-device-plugin, yace, crossplane-provider-family-aws-fips, src-fingerprint, crossplane-provider-kubernetes-fips, amass, gendesk, kubernetes-dashboard-api, longhorn-backing-image-manager-fips, quic-go-fips,...

[SECURITY] Fedora 43 Update: rust-eif_build-0.2.1-6.fc43

This CLI tool provides a low level path to assemble an enclave image format EIF file used in AWS Nitro Enclaves...

GHSA-96PQ-HXPW-RGH8 Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Summary - The saveimagesAsset graphql mutation allows a user to give a url of an image to download. Url must use a domain, not a raw IP. - Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 special AWS metadata IP - Attacker invokes saveimagesAsset with url...