EUVD-2025-209813

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

EUVD-2025-209814

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

CVE-2026-56661: Server-Side Request Forgery (SSRF)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...

CVE-2026-55232: Server-Side Request Forgery (SSRF)

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

PT-2026-103976

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.6 Description The SSRF guard in the CMS resolves hosts using an IPv4-only function and fails to inspect IPv6 addresses. Consequently, any host lacking an A record bypasses the private-range check. An authenticated...

PT-2026-105108

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

PT-2026-104070

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to access the complete device shadow of any device. By specifying a device...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init (ALMALINUX9.2:CLSA-2026:1782809708)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782809708 advisory. - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could...

PT-2026-103825

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

Rocky Linux 8 [CIQ] Security Update: cloud-init (crlsa-2021_3081)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20213081 advisory. cloud-init: randomly generated passwords logged in clear-text to world-readable file CVE-2021-3429 Tenable has extracted the preceding description block directly fr...

Rocky Linux 8 [CIQ] Security Update: cloud-init (crlsa-2025_11324)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202511324 advisory. cloud-init: Cloud init permissions flaw CVE-2024-6174 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

Rocky Linux 9.4 [CIQ] Security Update: cloud-init (ciqsa-2026_0522)

The Rocky Linux 9.4 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20260522 advisory. This advisory aggregates security fixes for the cloud-init SRPM in CIQ LTS 9.4. It addresses 1 CVE: CVE-2024-6174. Tenable has extracted the preceding description...

Rocky Linux 8.8 [CIQ] Security Update: cloud-init (ciqsa-2026_0383)

The Rocky Linux 8.8 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20260383 advisory. This advisory aggregates security fixes for the cloud-init SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2024-6174. Tenable has extracted the preceding description...

Rocky Linux 9.2 [CIQ] Security Update: cloud-init Multiple Vulnerabilities (ciqsa-2026_0401)

The Rocky Linux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260401 advisory. This advisory aggregates security fixes for the cloud-init SRPM in CIQ LTS 9.2. It addresses 4 CVEs: CVE-2024-6174, CVE-2021-3429, CVE-2020-8631,...

Rocky Linux 9.6 [TuxCare] Security Update: cloud-init (ALMALINUX9.6:CLSA-2026:1779098063)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779098063 advisory. - cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permission...

Rocky Linux 8.6 [CIQ] Security Update: cloud-init Multiple Vulnerabilities (ciqsa-2026_0018)

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260018 advisory. This advisory aggregates security fixes for the cloud-init SRPM in CIQ LTS 8.6. It addresses 5 CVEs: CVE-2024-6174, CVE-2021-3429, CVE-2020-8631,...

AlmaLinux 9.6 [TuxCare] Security Update: cloud-init (ALMALINUX9.6:CLSA-2026:1779098063)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779098063 advisory. - cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions,...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init (ALMALINUX9.2:CLSA-2025:1760025490)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760025490 advisory. - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed password...

CVE-2026-102095

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

CVE-2024-58387

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...