Passwords stored in plain text by fitnesse

fitnesse 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, the...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security Update (Critical) (RHSA-2026:28376)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:28376 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers ca...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission checks in the store method of the UsersController. An attacker can assign full administrative privileges to a newly...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the BulkAssetsController::update process. An attacker can gain unauthorized access to assets belonging to other companies...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

GHSA-25MH-HP8X-CGRV vulnerabilities

Vulnerabilities for packages: harvester, harvester-fips, docker-machine-driver-harvester, virt-operator-fips, virt-launcher, virt-controller-fips, virt-handler...

CVE-2025-14525 vulnerabilities

Vulnerabilities for packages: harvester, harvester-fips, docker-machine-driver-harvester, virt-operator-fips, virt-launcher, virt-controller-fips, virt-handler...

CVE-2024-31420 vulnerabilities

Vulnerabilities for packages: harvester, harvester-fips, virt-operator, virt-operator-fips, virt-launcher, virt-controller-fips...

CVE-2024-33394 vulnerabilities

Vulnerabilities for packages: harvester, harvester-fips, virt-operator, virt-operator-fips, virt-launcher, virt-controller-fips...

GHSA-4Q63-MR2M-57HF vulnerabilities

Vulnerabilities for packages: harvester, harvester-fips, virt-operator, virt-operator-fips, virt-launcher, virt-controller-fips...

GHSA-VJHF-6XFR-5P9G vulnerabilities

Vulnerabilities for packages: harvester, harvester-fips, virt-operator, virt-operator-fips, virt-launcher, virt-controller-fips...

GHSA-RJFV-PJVX-MJGV vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller, aws-load-balancer-controller-fips...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, harbor-registry-fips, crossplane-provider-azure-relay, kserve-localmodelnode-agent, crossplane-provider-aws-elasticache, crossplane-provider-aws-elb-fips, cert-manager-csi-driver, knative-operator-fips, zitadel, vitess, cerbos-fips,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, harbor-registry-fips, crossplane-provider-azure-relay, kserve-localmodelnode-agent, crossplane-provider-aws-elasticache, crossplane-provider-aws-elb-fips, cert-manager-csi-driver, knative-operator-fips, zitadel, vitess, cerbos-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: packer-fips, kubescape-server-fips, kaniko-fips, amazon-ecs-agent, trivy-operator-fips, cloudbeat, helm-mapkubeapis, crossplane-fips, eksctl, buildkitd-fips, tigera-operator, trivy-fips, chartmuseum-fips, docker-cli-buildx, buildkitd, kubescape, trivy-operator,...

Stored-XSS-via-Role-Attributes

Ziti Admin Console — Security Report Store...

Malware in carousel-controller-mixin

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview carousel-controller-mixin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

samba: Remote Code Execution in SAMR

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper...

PT-2026-51642

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1 Description Snipe-IT is an IT asset and license management system. A flaw exists where the update function within app/Http/Controllers/Assets/BulkAssetsController.php accepts the company id variable directly fr...