1167220 matches found
CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials configured for git...
CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software TACoS Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials configured for git...
CVE-2026-116489
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query...
CVE-2026-92171
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site xsite TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments -tlskeystorepassword, -tlstruststorepassword. Container arg...
CVE-2026-116489 Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query...
CVE-2026-116489
Timescale pgvectorscale versions prior to 0.9.1 are vulnerable to a type confusion vulnerability caused by unqualified DiskANN operator classes. This flaw allows low-privileged database users with CREATE privileges on the vectorscale schema to shadow pgvector types or operators. By pre-creating s...
EUVD-2026-109907
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query...
CVE-2026-92171 Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site xsite TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments -tlskeystorepassword, -tlstruststorepassword. Container arg...
CVE-2026-92171
A flaw in the Infinispan Operator for Red Hat Data Grid allows for sensitive information disclosure when cross-site (xsite) TLS is enabled. The operator launches the Gossip Router container using keystore and truststore passwords as plain-text command-line arguments (-tls_keystore_password, -tls_...
EUVD-2026-109942
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site xsite TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments -tlskeystorepassword, -tlstruststorepassword. Container arg...
CVE-2026-92171
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site xsite TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments -tlskeystorepassword, -tlstruststorepassword. Container arg...
CVE-2026-115189
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they...
EEF-CVE-2026-109584 HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK...
AI Halloween videos: Who’s getting your photos?
.kadence-column4801654ecc5f-ac .kt-inside-inner-colpadding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;.kadence-column4801654ecc5f-ac .kt-inside-inner-colcolumn-gap:var--global-kb-gap-sm, 1rem;.kadence-column4801654ecc5f-ac...
CVE-2026-115189
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...
CVE-2026-115189
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...
EUVD-2026-109792
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...
CVE-2026-115189
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic . The sandbox, originally intended to restrict user-uploaded theme templates (as a fix for GHSA-9fx4-7cmj-47vg), fails to fully enforce restrictions, allowing a crafted template to escape the sandb...
CVE-2026-116469
MISP Guard, a proxy-based security filter for MISP Malware Information Sharing Platform feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions checkrequiredtaxonomyexists, checkrequiredtaxonomytagsallowed, checkblockedattributecategories, and...