13532 matches found
Debian dla-4688 : ata-modules-6.1.0-48-armmp-di - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4688 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4688-1 [email protected]...
Oracle Linux 10 : image-builder (ELSA-2026-22937)
The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-22937 advisory. 58-1.0.1 - v58 with osbuild/images v0.256.0 with OL support patches - Add Azure image type - Correct dnf-plugin-spacewalk package filters 56-1.0.1 -...
github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...
Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.0.1
external secrets operator for Red Hat OpenShift 1.0.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...
PT-2026-60486
Name of the Vulnerable Software and Affected Versions Microsoft Office 365 Integration plugin versions prior to 4.5.6 Microsoft Office 365 Integration plugin versions prior to 5.0.5 Microsoft Office 365 Integration plugin versions prior to 5.1.1 Description The Microsoft Office 365 Integration...
image-builder security update
58-1.0.1 - v58 with osbuild/images v0.256.0 with OL support patches - Add Azure image type - Correct dnf-plugin-spacewalk package filters 56-1.0.1 - v56 with osbuild/images v0.254.0 with OL support patches - Add gce gcp image type to OL distro types 55-1.0.1 - v55 with osbuild/images v0.252.0 wit...
SUSE CVE-2025-3879
Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...
BIT-PROMETHEUS-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...
Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid
This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...
Exploit for CVE-2026-50338
CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-I...
EUVD-2026-44028
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...
EUVD-2026-43792
Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network...
Vulnerabilities in Microsoft Azure
Microsoft has identified vulnerabilities in various Azure components. Malicious actors could exploit these vulnerabilities to cause denial-of-service attacks, circumvent security measures, or gain elevated privileges, potentially allowing them to access data that they were not originally authoriz...
CVE-2026-15642
Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclud...
CVE-2026-15642
The CVE-2026-15642 issue affects Devolutions Server (2026.1.22.0 and 2026.2.11.0), specifically the Recovery Kit response file generation feature. The root cause is the insertion of sensitive data into a generated response file, which allows an attacker with access to that file to extract the Azu...
CVE-2026-15642
Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclud...
CVE-2026-58279
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...
CVE-2026-57969
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...