CVE-2026-97032 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-97032 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-97032 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-97032 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-78660 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78660 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78660 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-78660 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-78659 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78659 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78663 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78663 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78659 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-78659 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-78663 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-78663 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-81870 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-81870 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78669 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

CVE-2026-78669 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10. A patched version of the package is available...

CVE-2026-78669 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78669 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

EUVD-2026-102481

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

PT-2026-116096

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

CVE-2026-111675: Improper Restriction of Excessive Authentication Attempts

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can...

PT-2026-116074

🚨 CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's...

CVE-2026-111323 RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/EFI: The deferral of freeing boot services memory The efifreebootservices function frees the memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issues with this approach:...

Cloud-Penetration-Testing-Umar3P

Cloud Pentesting Cloud penetration testing assesses the secur...

Security Bulletin: Due to the use of jackson-databind, IBM Cloud Pak System is affected by Uncontrolled Resource Consumption and Deserialisation of Untrusted Data

Summary Jackson-databind is used internally by IBM Cloud Pak System CVE-2026-83557 and CVE-2026-68497 . These vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the...