CVE-2026-74242 Quay: repository notification uuid idor in quay api

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

CVE-2026-74242

Affects Red Hat Quay. The issue allows a repository administrator to read a notification’s configuration (including webhook URLs, Slack tokens, and email addresses) by knowing or guessing the target notification UUID, and to trigger test notifications for another repository. Root cause: unauthori...

CVE-2026-74243

A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...

CVE-2026-74242

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

CVE-2026-13198

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

CVE-2026-13198 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and...

Apple now uses iPhone alerts for targets of mercenary spyware

Apple has expanded its threat-notification system for targets of mercenary spyware. Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning...

Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware

Apple on Thursday sent a fresh batch of notifications to customers whom it suspects may have been targeted by mercenary spyware attacks. In a statement shared with TechCrunch, the iPhone maker said it alerted an unspecified number of users targeted in 110 countries and that it has notified...

WordPress Fluent Forms plugin <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability

Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability discovered by Adrien Brunner in WordPress Plugin FluentForm versions = 6.2.11...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: amazon-k8s-cni-fips, localstack, dkron, flux-notification-controller, nova, polaris, flux-source-watcher, pgwatch, grafana-operator-fips, flux-fips, victoriametrics-fips, temporal-fips, grafana-fips, loki-fips, victoriametrics-cluster-fips, metacontroller,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, atlantis, crossplane-provider-aws-route53, buildah, cilium-cli, melange, gomplate, flux, terragrunt, crossplane-provider-azure-authorization, kubernetes-dashboard, splunk-otel-collector, mattermost, step-issuer, spire-server, podman,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, kubeflow-katib, cfssl, redka, runc, kube-bench, nri-mongodb, ctop, wave, bom, cilium-cli, manifest-tool, terraform-provider-time, redis-operator, vertical-pod-autoscaler, pgtimetable, volume-modifier-for-k8s, blobfuse2,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, crossplane-provider-azure, bank-vaults, timestamp-authority, fulcio, tkn, flux-helm-controller, pulumi, gomplate, flux, policy-controller, scorecard, src-fingerprint, zot, terragrunt, rook, crossplane-provider-azure-storage,...

CVE-2026-74242: Authorization Bypass Through User-Controlled Key

A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability al...

PT-2026-72128

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description An Insecure Direct Object Reference IDOR exists where a repository administrator can access notification configurations of other repositories by knowing or guessing the Universally Uniqu...

CVE-2026-74243: Missing Authentication for Critical Function

A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...

SUSE CVE-2026-62420

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...

EUVD-2026-58069

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...