CVE-2026-73137

A flaw in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM) allows a tenant with HelmRelease create permissions to manipulate the secretRef.Namespace field. The GetSecret() function in the HelmRelease controller fails to restrict namespace scope, enabl...

EUVD-2026-63590

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

CVE-2026-73137

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

CVE-2026-73040 Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

CVE-2026-73040 Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

EUVD-2026-63588

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

CVE-2026-19755 NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-66002

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

CVE-2026-64777

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0...

CVE-2026-53586

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-53424

creationtimestamp| type| source ---|---|--- 2026-08-20 19:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjx4cg2wl2j 2026-08-20 20:07:37+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtk2d66bz72e...

EUVD-2026-63575

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0...

CVE-2026-64777

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0...

CVE-2026-64777

CVE-2026-64777 affects Apple's container tool. A malicious builder peer can request an in-context file by name from the host and receive the contents of whatever that name resolves to, even when it resolves outside the build context . This is a path-traversal-style information disclosure: the fil...

CVE-2026-73256

creationtimestamp| type| source ---|---|--- 2026-08-20 18:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjvyie3f52c 2026-08-20 19:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjwlhlixg2r 2026-08-20 20:08:25+00:00| seen|...

python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation

A flaw was found in Python's pkgutil.getdata function, which is used to retrieve data from packages. This function did not properly validate the resource argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories store...

Wagtail: Improper permission handling when copying snippets

Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. Workaroun...

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Impact The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections...