SUSE CVE-2026-54069

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empt...

SUSE CVE-2026-55427

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder config-ssh wrote server-supplied SSH settings HostnameSuffix, SSHConfigOptions into the user's /.ssh/config without sanitizing embedded newlines or...

CVE-2026-67596

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can...

CVE-2026-14522 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

CVE-2026-54366 CentreStack < 17.4 XXE via SharePoint Storage Configuration

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

CVE-2026-18378

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

EUVD-2026-51094

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CLEANSTART-2026-IU37943 Security fixes in cloud-config-server 4.3.2-r3

Package cloud-config-server version 4.3.2-r3 fixes 38 vulnerabilities: CVE-2026-33870, CVE-2026-33871, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587...

CLEANSTART-2026-YS49357 Security fixes in cloud-config-server 4.3.2-r2

Package cloud-config-server version 4.3.2-r2 fixes 15 vulnerabilities: CVE-2026-41293, CVE-2026-43512, CVE-2026-43515, CVE-2026-41284, CVE-2026-42498...

CLEANSTART-2026-RM20844 Security fixes in cloud-config-server 4.3.4-r0

Package cloud-config-server version 4.3.4-r0 fixes 15 vulnerabilities: CVE-2026-41293, CVE-2026-43512, CVE-2026-43515, CVE-2026-41284, CVE-2026-42498...

CVE-2026-44092 Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings (CVE-2026-14522 & CVE-2026-14519)

Summary IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings. Vulnerability Details CVEID:CVE-2026-14522 DESCRIPTION: IBM App Connect Enterprise could allow a remote attacker to execute arbitrary commands due to improper neutralization...

PT-2026-66459

Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...

CVE-2026-5056

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2026-5056

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2026-66724 Permission Bypass Via Undocumented HTTP Methods In MWDB Core

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

CVE-2026-66724 Permission Bypass Via Undocumented HTTP Methods In MWDB Core

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...