Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files

A flaw was found in Apache Tomcat. The cloud membership for clustering component was vulnerable to the insertion of sensitive information into log files. This vulnerability could lead to the exposure of the Kubernetes bearer token, which is a credential used for authentication within a Kubernetes...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via improper validation of symbolic links in the virt-handler process. An attacker can gain unauthorized access to privileged Unix sockets on the host by replacing a virtual machine console socket with a symlink to a...

Important: Red Hat Security Advisory: RHACS 4.10.3 security and bug fix update

Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...

Important: Red Hat Security Advisory: fence-agents security update

An update for fence-agents is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...

allennlp (>=2.2.1.dev20210408, <=2.7.0), allennlp-dataframe-mapper (0.2.1) +20 more potentially affected by CVE-2026-4372 via transformers (4.5.1)

transformers PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.2.1.dev20210408, =2.2.1.dev20210329, =0.0.0.2, =1.37.0, =0.0.1, =0.1.0, =0.3.0b1, =0.0.1, =1.0.23, =1.1.3 - nlp-nn 0.0.11.0...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, manifest-tool, steampipe, k3s, kargo, fuse-overlayfs-snapshotter, docker-cli-buildx, wolfictl, zarf, consul-k8s, docker-compose, scorecard, ctop, xeol, kots, eksctl, opa-envoy, kubevela, teleport, grype, kaniko, trivy-operator,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, manifest-tool, steampipe, k3s, kargo, fuse-overlayfs-snapshotter, docker-cli-buildx, wolfictl, zarf, consul-k8s, docker-compose, scorecard, ctop, xeol, kots, eksctl, opa-envoy, kubevela, teleport, grype, kaniko, trivy-operator,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: falco-no-driver, docker-cli-buildx, grype-fips, opa-fips, scorecard, newrelic-infrastructure-agent, kgateway, upwind-agent, k9s, cloudbeat-fips, linkerd2, zot, opa-fips-envoy, redpanda-operator, cloudbeat, datadog-agent, chartmuseum-fips, spegel, osv-scanner,...

Mattermost Server 10.11.x <= 10.11.13 / 11.5.x <= 11.5.1 Multiple Vulnerabilities (MMSA-2026-00570 / MMSA-2026-00575 / MMSA-2026-00582 / MMSA-2026-00622)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities: - Mattermost fails to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an...

GHSA-CHF8-4HV6-8PG6 Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

Summary The Fission storagesvc component registers archive CRUD handlers /v1/archive GET / POST / DELETE and /v1/archives list directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the storagesvc ClusterIP — including any other workload in th...

MAL-2026-4617 Malicious code in n8n-nodes-pentest-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a813bc4a209e75b50151451de1c2a3c4a7e916b181b314416eafc43492b4eb5 On npm install, the package's postinstall script runs a shell pipeline that reads the Kubernetes service-account token from...

PT-2026-42619

Summary mcp-server-kubernetes exposes three environment variables ALLOW ONLY READONLY TOOLS, ALLOW ONLY NON DESTRUCTIVE TOOLS, ALLOWED TOOLS documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer tools/list...

PT-2026-42684

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.23.0 Description The storagesvc component registers archive CRUD handlers on its HTTP router without authentication or authorization. This allows any caller capable of reaching the storagesvc ClusterIP, such as othe...

org.glassfish.main.admingui:admingui (>=7.0.0-m10, <=9.0.0-m1), org.glassfish.main.admingui:console-cluster-plugin (>=7.0.0-m10, <=9.0.0-m1) +20 more potentially affected by CVE-2026-2586 via org.glassfish.jsftemplating:jsftemplating (>=4.0.0, <=4.1.0)

org.glassfish.jsftemplating:jsftemplating MAVEN version =4.0.0, =7.0.0-m10, =7.0.0-m10, =7.0.16, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =7.0.0-m10, =9.0.0-m1 and more Source cves: CVE-2026-2586 Sour...

ANT-2026-DJBBBBPE · temporalio/temporal · Broken Access Control

broken-access-control low CVE-2026-5199 Severity Claude critical · Security research firm - · Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-DJBBBBPE: Cross-namespace manipulation including deletion of workflows on the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: A bug that led to out-of-bounds access was fixed in the mchpipcgetclusteraggrirq function. The clustercfg array is dynamically allocated to hold per-CPU configuration structures. Its size is determined by t...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring: Fixed a fget leak when the file system does not support nowait buffered reads. Heming reported a bug when using iouring for link-cp operations on ocfs2. 1 The following steps can reproduce this bug: mount -t ocfs2 /dev/v...

PT-2026-78511

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Wazuh versions 5.0.0-beta1 through 5.0.0-beta2 Description An issue exists where the cluster.unmerge info function in framework/wazuh/core/cluster/cluster.py constructs paths using peer-controlled merge type...

Veritas InfoScale CmdServer Access Control Vulnerability

Veritas InfoScale CmdServer is a command execution and remote management service component provided by Veritas Corporation in the US, designed for InfoScale cluster environments. Versions of Veritas InfoScale CmdServer prior to 7.4.2 contained an access control vulnerability, which was caused by...

Veritas Technologies Infoscale Operations Manager: Cross-site Request Forgery Vulnerability

Veritas Technologies Infoscale Operations Manager is a software developed by Veritas Technologies in the United States, used for managing the entire InfoScale deployment. This software offers features such as multi-cluster management, custom interfaces, and centralized audit logging. Version 9.1....