PT-2026-51811

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security Update (Critical) (RHSA-2026:28376)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:28376 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers ca...

Builds executed on the Jenkins controller by zapper can lead to RCE

zapper 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to. This allows attackers with Item/Configure permission to...

CVE-2026-57302: Plaintext Storage of a Password

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system...

Passwords stored in plain text by fitnesse

fitnesse 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, the...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission checks in the store method of the UsersController. An attacker can assign full administrative privileges to a newly...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the BulkAssetsController::update process. An attacker can gain unauthorized access to assets belonging to other companies...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

GHSA-VJHF-6XFR-5P9G vulnerabilities

Vulnerabilities for packages: virt-operator, harvester-fips, virt-launcher, virt-controller-fips, virt-operator-fips, harvester...

CVE-2024-33394 vulnerabilities

Vulnerabilities for packages: virt-operator, harvester-fips, virt-launcher, virt-controller-fips, virt-operator-fips, harvester...

GHSA-4Q63-MR2M-57HF vulnerabilities

Vulnerabilities for packages: virt-operator, harvester-fips, virt-launcher, virt-controller-fips, virt-operator-fips, harvester...

CVE-2025-14525 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, harvester-fips, virt-launcher, virt-controller-fips, virt-operator-fips, virt-handler, harvester...

CVE-2024-31420 vulnerabilities

Vulnerabilities for packages: virt-operator, harvester-fips, virt-launcher, virt-controller-fips, virt-operator-fips, harvester...

GHSA-25MH-HP8X-CGRV vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, harvester-fips, virt-launcher, virt-controller-fips, virt-operator-fips, virt-handler, harvester...

GHSA-RJFV-PJVX-MJGV vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller, aws-load-balancer-controller-fips...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kafkaconnect, crossplane-provider-aws-wafv2, kube-logging-operator, buildah-fips, argo-cd, cerbos, kubescape-operator-fips, argo-workflows, beats, longhorn-manager-fips, gitlab-cng-fips, crossplane-provider-kubernetes,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kafkaconnect, crossplane-provider-aws-wafv2, kube-logging-operator, buildah-fips, argo-cd, cerbos, kubescape-operator-fips, argo-workflows, beats, longhorn-manager-fips, gitlab-cng-fips, crossplane-provider-kubernetes,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: kots, helmfile, headlamp-fips, zarf-fips, kubescape-operator-fips, docker-cli-buildx-fips, k8ssandra-client, cloudbeat, cluster-api-helm-controller, docker-compose-fips, kubevela, chaos-mesh, kube-arangodb, harvester-fips, envoy-gateway, gitlab-rails-ce,...

samba: Remote Code Execution in SAMR

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper...

The vulnerability of the Custom Resource Definition (CRD) component of the NGINX Gateway Fabric web server controller allows a attacker to read and modify data, or cause a service failure.

The vulnerability of the Custom Resource Definition CRD component of the NGINX Gateway Fabric web server controller is related to the failure to eliminate special elements when processing string values. Exploiting this vulnerability may allow an attacker to gain read and modify access to data, or...