CVE-2026-62775: Incorrect Authorization

Incorrect authorization in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to disclose information locally...

CVE-2026-62772: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to elevate privileges locally...

PT-2026-70152

Name of the Vulnerable Software and Affected Versions OpenShift Console affected versions not specified Description A Server-Side Request Forgery SSRF and supply chain flaw exists in the OpenShift Console Helm catalog proxy. A namespace tenant can create a ProjectHelmChartRepository using an...

PT-2026-70524

Name of the Vulnerable Software and Affected Versions Windows Container Isolation FS Filter Driver unionfs.sys affected versions not specified Description A heap-based buffer overflow occurs in the Windows Container Isolation FS Filter Driver unionfs.sys. This issue allows an authorized attacker ...

PT-2026-70860

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the Atlas Vector Search feature allows an authenticated user with read access to one view to retrieve documents from a different, protected view sharing the same underlying...

CVE-2026-72764: Exposure of Resource to Wrong Sphere

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...

RHEL 10 : thunderbird (RHSA-2026:53445)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53445 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

RHEL 8 : thunderbird (RHSA-2026:53455)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53455 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

RHEL 9 : thunderbird (RHSA-2026:53475)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53475 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

RHEL 8 : thunderbird (RHSA-2026:53453)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53453 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

RHEL 9 : thunderbird (RHSA-2026:53444)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53444 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

RHEL 8 : thunderbird (RHSA-2026:53454)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53454 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

RHEL 9 : thunderbird (RHSA-2026:53446)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53446 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

CVE-2026-18949

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account SA token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to...

CVE-2026-18949

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account SA token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to...

EUVD-2026-55819

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account SA token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to...

CVE-2026-18949

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account SA token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to...

CVE-2026-18942 Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

Authorization Bypass Through User-Controlled Key

Overview apache-airflow-providers-yandex is a Provider package apache-airflow-providers-yandex for Apache Airflow Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the LockboxSecretBackend getconnvalue and getvariable lookups in...

CVE-2026-72719

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...