BIT-KYVERNO-2026-84196 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

cockpit-image-builder security update

An update is available for cockpit-image-builder. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The image-builder-frontend generates custom images suitable fo...

DEBIAN-CVE-2026-97971

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens takes a reference on the candidate namespace before maylistns has decided whether the caller may see it. The freensput cleanup on the denied path c...

CVE-2026-97971 nstree: check listing permission before taking a namespace reference

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens takes a reference on the candidate namespace before maylistns has decided whether the caller may see it. The freensput cleanup on the denied path c...

EUVD-2026-86825

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens takes a reference on the candidate namespace before maylistns has decided whether the caller may see it. The freensput cleanup on the denied path c...

CVE-2026-12037

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-12037

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 1.4.0.5 . The vulnerability exists via the 'page_url' parameter and is only exploitable when an administrator has configured the plugin's dom_get_type...

CVE-2026-12037 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

EUVD-2026-86575

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-12037 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-97731

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

EUVD-2026-86510

MinIO through 7aac2a2 does not verify that every x-amz- header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a...

CVE-2026-97731

Versions of MinIO through 7aac2a2 and pgsty/silo before 1233254 are vulnerable to a security flaw where the system fails to verify if all received x-amz-* headers are present in the client-supplied X-Amz-SignedHeaders list. Specifically, the extractSignedHeaders() function in cmd/signature-v4-uti...

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby...

CVE-2026-88032

A flaw was found in the MongoDB Java Driver. A use-after-free vulnerability in the reactive client-side encryption component can occur when an encrypted operation is cancelled. An attacker able to cause such an operation to be cancelled may cause the hosting application process to terminate. This...

PT-2026-98635

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimize ns takes a reference on the candidate namespace before may list ns has decided whether the caller may see it. The freens put cleanup on the denied pa...

PT-2026-98380

Name of the Vulnerable Software and Affected Versions Asset CleanUp: Page Speed Booster versions prior to 1.4.0.6 Description Server-Side Request Forgery occurs via the page url parameter. Authenticated attackers with administrator-level access or higher can initiate web requests to arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-79310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that...

Linux Distros Unpatched Vulnerability : CVE-2026-96747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in .sock as a local Unix domain...

RockyLinux 10 : cockpit-image-builder (RLSA-2026:71543)

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:71543 advisory. fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri: fast-uri: Server-side request forgery v...