PT-2026-97542

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description A flaw in the notification subsystem occurs because the recipient value from NotificationTemplate.notification configuration is copied in clear text into the unprotected...

PT-2026-97545

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description An unauthenticated remote attacker can enumerate Job Template and Workflow Job Template IDs that have Bitbucket Data Center webhooks configured. This...

PT-2026-97549

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A server-side request forgery flaw exists in the email notification backend. The system passes the user-supplied SMTP host and port from a notificati...

PT-2026-97547

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the deep-copy permission sanitizer when a WorkflowJobTemplate is copied. The sanitizer validates the inventory, unified job template...

PT-2026-97507

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists where the host config key provisioning-callback secret is exposed to users with only the view jobtemplate read-level permission...

PT-2026-97510

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller affected versions not specified Description An argument-injection flaw exists in the automation-controller where the Project scm url field is not validated against values starting with ...

PT-2026-97540

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the custom Credential Type environment-variable injector. The system validates variable names using a deny-list consisting of an...

PT-2026-97369

Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1 Description A path traversal issue exists in the compress method exposed through the '/filemanager/controller' endpoint. An authenticated remote attacker who owns a configured domain can provide absolute or out-of-scop...

CVE-2026-79304

CyberPanel version 1.9.1 is vulnerable to a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker who owns any configured domain can exploit this by supplying an arbitrary absolute or out-of-scope path in the fileName...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Critical) (RHSA-2026:71115)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71115 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

PT-2026-97548

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the WorkflowJobNode.ancestor artifacts database column, which stores raw merged set stats artifacts propagated between workflow node...

congo-lab (>=0.7.1, <=0.8.0), ezbeq (>=1.0.0b17, <=2.2.1) +8 more potentially affected by CVE-2026-77528 via autobahn (23.6.2)

autobahn PYPI version 23.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - congo-lab =0.7.1, =1.0.0b17, =0.2.0, =7.0.0, =1.2.4, =1.0.0, =3.0.0 - yangsuite-devices 2.8.7 Source cves: CVE-2026-77528 Source advisory:...

CVE-2026-94455

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

EUVD-2026-84547

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-65127

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-65128

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2026-65129

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service...

CVE-2026-65130

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2026-65117

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure...