freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 Escalada de privilegios local en FreeBSD medianteexecargsadjustargs con memmove fuera de límites Un error de precedencia de operadores en execargsadjustargs sys/kern/kernexec.c, presente desde 2013...

trivy-enforcer

trivy-enforcer EXPERIMENTAL Operador de Kubernetes para el aseguramiento de imágenes Funciona como Controlador de admisión Evita que se desplieguen imágenes inseguras Controlador personalizado Observa el CRD ImageVulnerability y escanea la imagen en el recurso personalizado automáticamente...

CVE-2024-53900

Desafío CTF - Mongoose RCE CVE-2024-53900 Resumen del Desafío Este desafío de Captura la Bandera CTF está basado en CVE-2024-53900, una vulnerabilidad en Mongoose que permite la Ejecución Remota de Código RCE debido al uso incorrecto del operador $where en consultas MongoDB. ¡Tu objetivo es...

CVE-2018-16509

CVE-2018-16509 Campo de pruebas Docker "Se descubrió un problema en Artifex Ghostscript anterior a la versión 9.24. La comprobación incorrecta de la «restauración de privilegios» durante el manejo de excepciones /invalidaccess podría ser utilizada por atacantes capaces de proporcionar PostScript...

BIT-PARSE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

ruby:2.5 security update

An update is available for rubygem-mysql2, module.rubygem-mysql2, module.rubygem-bundler, module.ruby, module.rubygem-mongo, module.rubygem-pg, module.rubygem-bson, ruby, rubygem-bundler, rubygem-abrt, rubygem-pg, rubygem-mongo, module.rubygem-abrt, rubygem-bson. This update affects Rocky Linux 8...

Homomorphic Advantage Operator: Stabilizing Reinforcement Learning under Fully Homomorphic Encryption Constraints

Privacy-preserving machine learning presents significant deployment challenges on the cloud for intelligent systems with confidential data. Fully Homomorphic Encryption FHE offers a compelling solution for secure computation, preserving data confidentiality of cloud computations. However, applyin...

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

Important: Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update

An updated OpenShift File Integrity Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift File Integrity Operator v1.5.0 is now available. See the documentation for bug fix information:...

rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection

A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...

Important: Red Hat Security Advisory: ruby:2.5 security update

An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

EUVD-2026-89959

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CVE-2026-101295

The oc-mirror tool is vulnerable to a path traversal and arbitrary file write flaw during the operator catalog image extraction process. When users mirror operator catalogs using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), the software fails to validate that extracted t...

CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

CLEANSTART-2026-DQ91908 On Linux, if the target of Root

Security vulnerability affects the minio-operator package. On Linux, if the target of Root...

CLEANSTART-2026-CL14809 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Security vulnerability affects the minio-operator package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

CLEANSTART-2026-PU50619 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the minio-operator package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-YO89791 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the minio-operator package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...