BIT-GHOST-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

OsTicket < 1.14.3 - Server Side Request Forgery

SSRF vulnerability exists in osTicket before 1.14.3, allowing an attacker to add malicious files to the server or perform port scanning. id: CVE-2020-24881 info: name: OsTicket 1.14.3 - Server Side Request Forgery author: hnd3884 severity: critical description: | SSRF vulnerability exists in...

CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-68469

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENTSLEEP -...

CVE-2026-74411

The CVE affects the Linux kernel with the wifi driver rtw89 (rtw89_core). The vulnerability arises in the 6 GHz scan path where the 6GHz channel-list scan loop uses an incorrect data type for the scan index, leading to an infinite/long loop and a soft lockup (CPU stuck for ~26s) during wifi scans...

EUVD-2026-59558

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

CVE-2026-68469

The CVE describes a Linux kernel wifi mwifiex driver issue where a sleep confirmation could be skipped due to ps_state being set to AWAKE during the association response, causing a forced wake and preventing a deferred sleep-confirm from being sent. This led to a permanently busy scans condition:...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, crossplane-provider-aws-amplify-fips, crossplane-provider-aws-codestarnotifications, kapp-controller, mcp-grafana, crossplane-provider-family-gcp-config, osv-scanner, vexctl, node-feature-discovery-fips, hubble-ui, envoy-ai-gateway-fip...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: harbor, spire-controller-manager, kustomize, cluster-proportional-autoscaler, fscrypt, gostatsd, k8s-device-plugin, rancher-webhook, kuberlr, oauth2-proxy, kuberay-operator, rancher-agent, terraform, nodetaint, smarter-device-manager, aws-signer-notation-plugin,...

GO-2025-3917 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, neuvector-scanner-fips...

GO-2025-4043 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, neuvector-scanner-fips...

GO-2024-2490 vulnerabilities

Vulnerabilities for packages: wolfictl, zarf, syft, k9s, grype, kubescape...

GO-2024-2912 vulnerabilities

Vulnerabilities for packages: dive...

GO-2026-6005 vulnerabilities

Vulnerabilities for packages: tigera-operator, gitlab-operator, gitlab-operator-fips, datadog-agent-fips, datadog-agent, tigera-operator-fips...

GO-2025-3533 vulnerabilities

Vulnerabilities for packages: dataplaneapi-fips, dataplaneapi, nuclei, timoni, gptscript...

GO-2025-3660 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, policy-controller-fips, policy-controller, cosign-fips, kyverno, kyverno-fips, spire-server, cosign, kyverno-notation-aws-fips, trivy, kots, tfsec, spire-server-fips, dapr-fips, trivy-fips, conftest-fips, witness, dapr, conftest...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, headlamp-fips, eksctl, nova-fips, helm-docs, k8sgpt, istio, chartmuseum, harbor, chart-testing, k9s, envoy-gateway-fips, helm-operator-fips, helm-mapkubeapis, headlamp, chart-testing-fips, teleport, zot, cluster-api-helm-controller-fips,...

GO-2026-5761 vulnerabilities

Vulnerabilities for packages: node-feature-discovery-fips, node-feature-discovery, rancher-agent, nvidia-container-toolkit, k8s-device-plugin, buildah, podman-fips, gpu-operator, cadvisor-fips, cadvisor, prometheus-podman-exporter-fips, podman, sriov-network-device-plugin,...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: rye, sqlx, atuin, cargo-audit, nushell, oranda, buck2, kdash, tealdeer, sccache, deno, zizmor, pixi, qdrant, rustup, fnm, linkerd2-proxy, ztunnel-fips, lychee, zola, ztunnel, xh, uv, wasmcloud, wash, wasm-pack, rustls-ffi, ntpd-rs, samply, shadowsocks-rust, wadm, zed...