870967 matches found
CGA-FJ7P-8VJG-H4Q5
Bulletin has no description...
CGA-C5QM-7WPH-GP2X
Bulletin has no description...
CVE-2026-118759 Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/runid/nodes/nodeid/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend a...
CVE-2026-118759
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/runid/nodes/nodeid/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend a...
CVE-2026-118759 Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/runid/nodes/nodeid/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend a...
CVE-2026-118759 Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/runid/nodes/nodeid/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend a...
CVE-2026-118759
In Kubeflow Pipelines versions prior to 2.18.0 , a vulnerability exists in the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler. The root cause is a failure to authorize callers against the selected run, allowing an attacker with network reachability to retrieve live or a...
CGA-XX83-2CH4-RCH5
Bulletin has no description...
Security update for flatpak
This update for flatpak fixes the following issues: CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc1282514...
SUSE-SU-2026:4944-1 Security update for flatpak
This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc128251...
urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser
A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...
urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override
A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security TLS settings inadvertently overwrite the proxy's TLS configuration, which can disabl...
CVE-2026-41940-Security-Patch
CVE-2026-41940-Security-Patch Unofficial temporary patch for the CVE-2026-41940 vulnerability Can be used for temporary defense Please upgrade to the official release as soon as conditions permit cPanel Security Announcement:...
CGA-6W2H-7C9Q-3882
Bulletin has no description...
CGA-2CM3-GV5W-R78H
Bulletin has no description...
CVE-2026-116531
A flaw was found in HTTP::Body. A remote attacker can cause a Denial of Service DoS or unexpected request processing by sending specially crafted chunked HTTP requests. This issue occurs because the module fails to properly track chunk boundaries when reading chunked request bodies. As a result,...
CVE-2026-117501
A flaw was found in HTTP::Body. By sending crafted chunked HTTP requests with malformed chunk sizes, a remote attacker can cause the parser to continuously buffer incoming data in memory. This issue leads to excessive memory consumption, resulting in a Denial of Service DoS for the affected...
CVE-2026-116795
A flaw was found in re2js. When lookbehind assertions are enabled, repeated regular expression matching can cause the engine to repeatedly rescan input text from the beginning, leading to quadratic processing time. A remote attacker could supply crafted input to monopolize worker thread resources...
CVE-2026-116134
A flaw was found in perl-http-body. The multipart request parser does not restrict the size or number of lines within a part's header block before storing them in memory. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large multipa...
CVE-2026-116132
A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service DoS by sending repeated incomplete multipart upload requests. The multipart parser creates a temporary file when a file part begins but fails to track or clean it up if the upload terminates prematurely, allowing an...