1357 matches found
EUVD-2026-58132
A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...
CVE-2026-73266
A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...
CVE-2026-73609
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the...
EUVD-2026-57813
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the...
CVE-2026-73609
SiYuan versions before v3.7.4 are affected by an information disclosure vulnerability in the getBookmarkLabels endpoint, which returns all bookmark labels in a workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across...
PT-2026-71706
Name of the Vulnerable Software and Affected Versions Multicluster Engine affected versions not specified Description A flaw in the clusterclaims-controller component allows an authenticated tenant to manipulate ClusterClaim labels. This manipulation enables a tenant to force a cluster to join a...
PT-2026-71437
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the 'getBookmarkLabels' endpoint. The system returns all bookmark labels within the workspace without applying publish-access filtering. This allows anonymous...
CVE-2026-19130
A flaw was found in the provider-credential-controller component of multicluster-engine MCE. An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker...
CVE-2026-72751
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
CVE-2026-72751
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
policycoreutils: policycoreutils: TOCTOU race condition in fixfiles allows arbitrary SELinux label manipulation
A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...
CVE-2026-19079
CVE-2026-19079 affects policycoreutils’ fixfiles script, where a TOCTOU race during relabel/restore allows a local attacker to swap directory components with symlinks and have chcon follow the link to label arbitrary files (e.g., /etc/shadow). The issue arises from using find to locate unlabeled ...
CVE-2026-19079 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...
CVE-2026-19079 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...
CVE-2026-19079 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...
CVE-2026-19079
A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...
Linux Distros Unpatched Vulnerability : CVE-2026-19079
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
keycloak-services: keycloak-services: Unbounded metric cardinality in user event metrics via request-controlled error text
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...
CVE-2026-16100
A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...