5195 matches found
CVE-2026-25492
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: fulcio, q, kubernetes-csi-external-snapshotter, docker-machine-driver-harvester, local-static-provisioner, kubernetes-dashboard-auth, kserve, bank-vaults, logstash-exporter, node-feature-discovery, cadvisor, crossplane-provider-aws-dynamodb,...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: fulcio, q, kubernetes-csi-external-snapshotter, docker-machine-driver-harvester, local-static-provisioner, kubernetes-dashboard-auth, kserve, bank-vaults, logstash-exporter, node-feature-discovery, kubernetes-csi-driver-hostpath, cadvisor,...
GHSA-8JVR-VH7G-F8GX vulnerabilities
Vulnerabilities for packages: fulcio, q, kubernetes-csi-external-snapshotter, docker-machine-driver-harvester, local-static-provisioner, kubernetes-dashboard-auth, kserve, bank-vaults, logstash-exporter, node-feature-discovery, kubernetes-csi-driver-hostpath, cadvisor,...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: sbom-convert, falco-exporter-fips, flannel-fips, grafana-beyla, gops-fips, nova-fips, s5cmd, grafana-agent-operator, gptscript, pushprox, cloud-sql-proxy, kubevela-fips, aws-network-policy-agent-fips, azcopy, custom-pod-autoscaler-operator-fips,...
GHSA-8JVR-VH7G-F8GX vulnerabilities
Vulnerabilities for packages: sbom-convert, falco-exporter-fips, flannel-fips, grafana-beyla, gops-fips, nova-fips, s5cmd, grafana-agent-operator, gptscript, pushprox, cloud-sql-proxy, kubevela-fips, aws-network-policy-agent-fips, azcopy, custom-pod-autoscaler-operator-fips,...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: falco-exporter-fips, flannel-fips, grafana-beyla, nova-fips, s5cmd, grafana-agent-operator, gptscript, pushprox, cloud-sql-proxy, kubevela-fips, aws-network-policy-agent-fips, azcopy, custom-pod-autoscaler-operator-fips, timestamp-authority-fips, vault-benchmark,...
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
Summary - The saveimagesAsset graphql mutation allows a user to give a url of an image to download. Url must use a domain, not a raw IP. - Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 special AWS metadata IP - Attacker invokes saveimagesAsset with url...
CVE-2026-25492 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveimagesAsset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...
PT-2026-7142
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save images Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a...
Ubuntu: Security Advisory (USN-8015-3)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-8013-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-8014-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Medium: aws-nitro-enclaves-cli
Issue Overview: openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Affected Packages: aws-nitro-enclaves-cli Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ sectio...
Medium: aws-nitro-enclaves-cli
Issue Overview: openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Affected Packages: aws-nitro-enclaves-cli Issue Correction: Run dnf update aws-nitro-enclaves-cli --releasever 2023.10.20260202 or dnf update --advisory ALAS2023-2026-1371 --releasever 2023.10.202602...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: gitlab-operator, step-issuer-fips, cert-manager-google-cas-issuer-fips, cert-manager-cmctl-fips, aws-privateca-issuer-fips, cert-manager-webhook-pdns, percona-xtradb-cluster-operator-fips, cert-manager-csi-driver-fips, cert-manager-istio-csr,...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-cmctl, mariadb-operator, opentelemetry-operator, percona-server-mongodb-operator, cert-manager-istio-csr, aws-privateca-issuer, step-issuer, cert-manager-csi-driver...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-cmctl, mariadb-operator, opentelemetry-operator, percona-server-mongodb-operator, cert-manager-istio-csr, aws-privateca-issuer, step-issuer, cert-manager-csi-driver...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: gitlab-operator, step-issuer-fips, cert-manager-google-cas-issuer-fips, cert-manager-cmctl-fips, aws-privateca-issuer-fips, cert-manager-webhook-pdns, percona-xtradb-cluster-operator-fips, cert-manager-csi-driver-fips, cert-manager-istio-csr,...