45087 matches found
CVE-2026-83991: Missing Authentication for Critical Function
Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally...
PT-2026-87326
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...
NewStart CGSL MAIN 7.02 : cloud-init Vulnerability (NS-SA-2026-0114)
The remote NewStart CGSL host, running version MAIN 7.02, has cloud-init packages installed that are affected by a vulnerability: - When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations...
CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...
CVE-2026-86539
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...
CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-27459 DESCRIPTION: pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-42960 DESCRIPTION: NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-81551 DESCRIPTION: DataStage on Cloud Pak for Data could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage...
CVE-2026-84965
creationtimestamp| type| source ---|---|--- 2026-09-07 13:15:26+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muwlooa74k2r...
CVE-2026-84964
creationtimestamp| type| source ---|---|--- 2026-09-07 13:15:26+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muwlooa74k2r...
Your Cloud Security Checklist Doesn't Work the Way You Think It Does
If managing security across multiple cloud providers wasn't hard enough, each one fails in a different way. For the 2026 Cloud Security Index, Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud and found that risk profiles across providers have...
Improper Interceptor Addition
Spring Cloud Stream is vulnerable to improper interceptor addition. The vulnerability is due to an improperly added PartitionInterceptor while sending a message, where the interceptor is attached without adequate validation and attackers can send crafted messages to manipulate message routing or...
Unbounded Cache Size
Spring Cloud Stream is vulnerable to an unbounded cache size. The vulnerability is due to improper bounding of the dynamic destination cache size, where the cache can grow without limit and attackers can trigger excessive memory usage to cause a denial‑of‑service condition...
Sensitive Data Logging
Spring Cloud Function is vulnerable to Sensitive Data Logging. The vulnerability is due to insufficient redaction of sensitive information in its logging mechanisms, where request or response data may be written to logs without filtering and attackers can trigger the function with secret‑containi...
Scheme Verification Bypass
Spring Cloud Function is vulnerable to Scheme Verification Bypass. The vulnerability is due to the implementation of the isSecure method in ServerlessHttpServletRequest not verifying the actual scheme, where the method can report a request as secure even when the scheme is not HTTPS and an attack...
Server-Side Request Forgery (SSRF)
Spring Cloud Function is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled file or resource paths, allowing an attacker to read arbitrary local files or make requests to attacker-controlled or internal resources...
Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities in various components
Summary IBM Cloud Pak for Data System 1.0 includes several open source and third-party components as part of its software stack. Multiple security vulnerabilities have been identified across various components including PLY, Apache HttpComponents, pyasn1, pip, and Eclipse Jetty. These...
Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)
Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 1.0 - NRS have been addressed in version 3.0.5.3 Vulnerability Details CVEID:CVE-2026-17467 DESCRIPTION: IBM Cloud Pak for Data System Yosemite 1.0 could allow a remote attacker to obtain sensitive information due to the...
VulnCheck KEV: CVE-2026-60105
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...