RHEL 10 : fence-agents (RHSA-2026:17083)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:17083 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or...

CVE-2026-44015

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CVE-2026-44015

CVE-2026-44015 describes SSRF in Nginx UI prior to 2.3.5 where an authenticated user can create a cluster node with an internal URL and trigger the Proxy middleware to forward requests using the X-Node-ID header, bypassing network segmentation and reaching localhost/internal services (including c...

CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CVE-2026-44015 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...

CVE-2026-42541 Kubewarden: RBAC Reconnaissance via unchecked can_i host capability call

Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions which isn't the default can craft a policy that makes use of the cani host callback. The callback issues a SubjectAccessReview SAR requests to enumerate...

Google Cloud AlloyDB for PostgreSQL 安全漏洞

Google Cloud AlloyDB for PostgreSQL is a cloud-native, high-performance relational database service from Google Inc. That service is compatible with PostgreSQL. Versions of Google Cloud AlloyDB for PostgreSQL prior to 2025-11-03 contained a security vulnerability. This vulnerability stemmed from...

Nginx UI 代码问题漏洞

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI 2.3.4 and earlier have code vulnerabilities. This vulnerability allows authenticated users to create cluster nodes that point to arbitrary internal URLs and send API requests with the X-Node-ID header, resulting in SSR...

CVE-2026-42600

Summary of the vulnerability (CVE-2026-42600) : MinIO’s ReadMultiple internode storage-REST endpoint is vulnerable to path traversal when processing a msgpack-encoded ReadMultipleReq body. An attacker holding the cluster root JWT can craft a request to POST /minio/storage/{drivePath}/v63/rmpl wit...

MinIO 路径遍历漏洞

MinIO is an open-source object storage server developed by the American company MinIO. This product supports the creation of infrastructures for machine learning, analysis, and application data workloads. Versions of MinIO from RELEASE.2022-07-24T01-54-52Z to RELEASE.2026-04-14T21-32-45Z had a pa...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-017456)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017456 advisory. Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 8.0.26 and prior. Difficult to explo...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-017453)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017453 advisory. Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: General. Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior,...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: telegraf, dask-gateway, kyverno, trino, prometheus, cilium-cli, prometheus-operator, flux, cilium, kaf, kubo, containerd, k3s, kots, k8s-device-plugin, aws-flb-cloudwatch, coredns, fluent-bit-plugin-loki, kubevela, karma, libnvidia-container, redka, aws-flb-kinesis,...

CVE-2026-39825 vulnerabilities

Vulnerabilities for packages: telegraf, dask-gateway, kyverno, trino, prometheus, cilium-cli, prometheus-operator, flux, cilium, kaf, kubo, containerd, k3s, kots, k8s-device-plugin, aws-flb-cloudwatch, coredns, fluent-bit-plugin-loki, kubevela, karma, libnvidia-container, redka, aws-flb-kinesis,...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: hubble, longhorn-manager-fips, terraform-fips, headlamp-fips, authentik, virt-operator-fips, ld-relay, fluent-bit-plugin-loki, aws-flb-firehose-fips, commercial-grafana, terraform, newrelic-fluent-bit-output-fips, longhorn-backing-image-manager-fips, kubernetes, etcd...

CVE-2026-39825 vulnerabilities

Vulnerabilities for packages: hubble, longhorn-manager-fips, terraform-fips, headlamp-fips, authentik, virt-operator-fips, ld-relay, fluent-bit-plugin-loki, aws-flb-firehose-fips, commercial-grafana, terraform, newrelic-fluent-bit-output-fips, longhorn-backing-image-manager-fips, kubernetes, etcd...

GHSA-P9H5-JM8X-MJM5 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, omni-fips, nats, cloud-provider-gcp-cloud-controller-manager-fips,...

CVE-2026-42499 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, omni-fips, nats, cloud-provider-gcp-cloud-controller-manager-fips,...

CVE-2026-39820 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudsearch, crossplane-provider-aws-networkmanager-fips, crossplane-provider-azure-synapse, crossplane-provider-azure-signalrservice, omni-fips, nats, cloud-provider-gcp-cloud-controller-manager-fips,...