EUVD-2026-57059

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to cop...

CVE-2026-70398 Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

EUVD-2024-55716

A vulnerability was identified in Open5GS up to 2.7.1. This issue affects the function pcrfrxaarcb of the file src/pcrf/pcrf-rx-path.c of the component Diameter Rx Handler. The manipulation of the argument numofmediacomponent/numofsub leads to buffer overflow. The attack can be initiated remotely...

PT-2026-70967

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

PT-2026-71058

Name of the Vulnerable Software and Affected Versions FortiClientWindows versions 7.4.0 through 7.4.3 FortiClientWindows versions 7.2.0 through 7.2.11 Description A classic buffer overflow occurs due to a buffer copy operation that does not verify the size of the input. This allows an...

PT-2026-71137

Multiple Use-After-Free vulnerabilities were found in the add archive element function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root cause is that plugin maybe claim in ld/plugin.c frees the original BFD object via bfd close/ bfd delete bfd when entry-the bfd-my archive =...

PT-2026-71054

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount...

PT-2026-71156

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability...

PT-2026-70968

Name of the Vulnerable Software and Affected Versions multicloud-operators-subscription affected versions not specified Description A flaw exists where a privileged user, such as a namespace administrator with permissions to create Channel and Subscription resources, can perform cross-namespace...

PT-2026-71050

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkou...

CVE-2026-73245

Kestra, an open-source event-driven orchestration platform, prior to 2.0.0-rc6 exposed Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env to disclose resolved configuration and POST /loggers/{...

CVE-2026-73245 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-64934

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

open-iscsi: open-iscsi: Privilege Escalation via Path Traversal

A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle MITM attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This...

CVE-2026-48813

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

UBUNTU-CVE-2026-48813

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813 Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

CVE-2026-48813

Vulnerability summary (CVE-2026-48813) : Flawfinder (C/C++ static analysis tool) versions prior to 2.0.20 are affected by improper input neutralization causing output manipulation. Specifically, untrusted inputs (filenames, categories, code context) can introduce Terminal/ANSI Escape Sequence Inj...

EUVD-2026-56901

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...