3061 matches found
DEBIAN-CVE-2026-89505
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...
UBUNTU-CVE-2026-89505
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...
CVE-2026-75584
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock function in bpsecutil.c passes bundle-payload.length to zcoclone without...
CVE-2026-75584 ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock function in bpsecutil.c passes bundle-payload.length to zcoclone without...
CVE-2026-75584
ION-DTN before 4.2.1-a.1 contains a denial-of-service vulnerability in the canonicalizePayloadBlock() function in bpsec_util.c . The function passes bundle->payload.length to zco_clone() without validating it against zero. An unauthenticated remote attacker can send a BPv7 bundle with a zero-l...
EUVD-2026-75456
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock function in bpsecutil.c passes bundle-payload.length to zcoclone without...
CVE-2026-75584 ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock function in bpsecutil.c passes bundle-payload.length to zcoclone without...
Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
SummaryAn authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundle...
Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
SummaryAn authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs.When the tool is invoked, the runner imports and...
Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
SummaryAn authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent.Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding ...
PYSEC-2026-3874 Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By addin...
PYSEC-2026-3875 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE
Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...
PYSEC-2026-3872 Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs. When the tool is invoked, the runner imports and...
PT-2026-89421
Name of the Vulnerable Software and Affected Versions ION-DTN versions prior to 4.2.1-a.1 Description A denial of service issue allows unauthenticated remote attackers to crash the ION process. This occurs when a BPv7 bundle with a zero-length payload is sent. Specifically, the...
CVE-2026-75584: Reachable Assertion
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock function in bpsecutil.c passes bundle-payload.length to zcoclone without...
CVE-2026-87059
A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process...
CVE-2026-87056
A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead...
CVE-2026-87058
A flaw was found in olm-operator-konflux-sample. The hermetic build mode is disabled by default, allowing bundle builds to perform live network fetches. This means that external, unverified resources can be pulled during the build process, potentially compromising the integrity and trustworthines...
OESA-2026-3623 git security update
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce, and...
OESA-2026-3622 git security update
Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce, and...