Meari IoT Cloud Platform OpenAPI Service (Update A)

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. 2. RECOMMENDED...

ROOT-APP-MAVEN-CVE-2025-41243 CVE-2025-41243 in org.springframework.cloud:spring-cloud-gateway-server-webflux - Patched by Root

Root has patched CVE-2025-41243 in the org.springframework.cloud:spring-cloud-gateway-server-webflux package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-41253 CVE-2025-41253 in org.springframework.cloud:spring-cloud-gateway-server - Patched by Root

Root has patched CVE-2025-41253 in the org.springframework.cloud:spring-cloud-gateway-server package for Root:Maven. Multiple fixed versions available...

EUVD-2025-209815

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting in loss of confidentiality or availability...

EUVD-2025-209813

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

EUVD-2025-209814

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

Rocky Linux 9.6 [TuxCare] Security Update: cloud-init (ALMALINUX9.6:CLSA-2026:1779098063)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779098063 advisory. - cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permission...

PT-2026-105108

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

Rocky Linux 9.4 [CIQ] Security Update: cloud-init (ciqsa-2026_0522)

The Rocky Linux 9.4 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20260522 advisory. This advisory aggregates security fixes for the cloud-init SRPM in CIQ LTS 9.4. It addresses 1 CVE: CVE-2024-6174. Tenable has extracted the preceding description...

Rocky Linux 9.2 [CIQ] Security Update: cloud-init Multiple Vulnerabilities (ciqsa-2026_0401)

The Rocky Linux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260401 advisory. This advisory aggregates security fixes for the cloud-init SRPM in CIQ LTS 9.2. It addresses 4 CVEs: CVE-2024-6174, CVE-2021-3429, CVE-2020-8631,...

Rocky Linux 8.6 [CIQ] Security Update: cloud-init Multiple Vulnerabilities (ciqsa-2026_0018)

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260018 advisory. This advisory aggregates security fixes for the cloud-init SRPM in CIQ LTS 8.6. It addresses 5 CVEs: CVE-2024-6174, CVE-2021-3429, CVE-2020-8631,...

PT-2026-103976

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.6 Description The SSRF guard in the CMS resolves hosts using an IPv4-only function and fails to inspect IPv6 addresses. Consequently, any host lacking an A record bypasses the private-range check. An authenticated...

PT-2026-104070

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to access the complete device shadow of any device. By specifying a device...

CVE-2026-56661: Server-Side Request Forgery (SSRF)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...

CVE-2026-55232: Server-Side Request Forgery (SSRF)

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

PT-2026-103825

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init (ALMALINUX9.2:CLSA-2025:1760025490)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760025490 advisory. - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed password...

Rocky Linux 8 [CIQ] Security Update: cloud-init (crlsa-2025_11324)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202511324 advisory. cloud-init: Cloud init permissions flaw CVE-2024-6174 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

Rocky Linux 8.8 [CIQ] Security Update: cloud-init (ciqsa-2026_0383)

The Rocky Linux 8.8 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20260383 advisory. This advisory aggregates security fixes for the cloud-init SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2024-6174. Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: cloud-init (crlsa-2021_3081)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20213081 advisory. cloud-init: randomly generated passwords logged in clear-text to world-readable file CVE-2021-3429 Tenable has extracted the preceding description block directly fr...