Lucene search
+L

2552906 matches found

EUVD
EUVD
added 2026/08/20 8:34 p.m.7 views

EUVD-2026-63590

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

7.7CVSS5.6AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/20 8:34 p.m.32 views

CVE-2026-73137 Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

7.7CVSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/08/20 8:34 p.m.7 views

CVE-2026-74359

A flaw was found in the Linux kernel's configfs component. This vulnerability occurs because a memory pointer is not properly cleared after a failure, leading to a 'use-after-free' condition. A local attacker could exploit this by interacting with the affected directory, which could cause memory...

7.8CVSS5.9AI score0.00125EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/20 8:34 p.m.16 views

CVE-2026-73137

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

7.7CVSS5.6AI score
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/08/20 8:34 p.m.3 views

CVE-2026-73137 Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

7.7CVSS5.6AI score
SaveExploits0References2
EUVD
EUVD
added 2026/08/20 8:34 p.m.8 views

EUVD-2026-63589

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

9.9CVSS5.5AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/20 8:34 p.m.32 views

CVE-2026-67567 Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

9.9CVSS
SaveExploits0References2
CVE
CVE
added 2026/08/20 8:34 p.m.26 views

CVE-2026-67567

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

9.9CVSS5.5AI score
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/08/20 8:34 p.m.6 views

CVE-2026-73137

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

7.7CVSS5.2AI score
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/08/20 8:34 p.m.8 views

CVE-2026-67567

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

9.9CVSS5.6AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/20 8:29 p.m.23 views

CVE-2026-73040 Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

8.8CVSS
SaveExploits0References7
CVE
CVE
added 2026/08/20 8:29 p.m.12 views

CVE-2026-73040

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

8.8CVSS5.5AI score
SaveExploits0References7
EUVD
EUVD
added 2026/08/20 8:29 p.m.7 views

EUVD-2026-63588

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

8.8CVSS5.5AI score
SaveExploits0References7
OSV
OSV
added 2026/08/20 8:29 p.m.2 views

CVE-2026-73040 Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

8.7CVSS5.7AI score
SaveExploits0References9
The Hacker News
The Hacker News
added 2026/08/20 8:22 p.m.7 views

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are...

6AI score
SaveExploits0
NVD
NVD
added 2026/08/20 8:17 p.m.10 views

CVE-2026-75910

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

7.1CVSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 8:06 p.m.3 views

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

7.1CVSS6AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/20 8:06 p.m.22 views

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

7.1CVSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/20 8:06 p.m.7 views

EUVD-2026-63585

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

7.1CVSS5.7AI score
SaveExploits0References3
CVE
CVE
added 2026/08/20 8:06 p.m.15 views

CVE-2026-75910

The ClickHouse connector deployment template in Amazon Athena Federated Query (versions before v2026.17.1) has an incorrect privilege assignment: an authenticated remote user can point the connector's connection string at an unrelated AWS Secrets Manager secret and a database endpoint they contro...

7.1CVSS5.7AI score
SaveExploits0References3
Rows per page
Query Builder