PT-2026-76665

Name of the Vulnerable Software and Affected Versions Dell ObjectScale versions prior to 4.3.0.1 Description The svc tools component allows the insertion of sensitive information into log files. A low privileged attacker with local access could exploit this issue to cause information disclosure...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: grafana-operator, flux-kustomize-controller, wave, terraform-provider-google, cosign, step, opencost, sealed-secrets, dbmate, kubernetes-event-exporter, spegel, configmap-reload, gke-gcloud-auth-plugin, thanos-operator, aws-eks-pod-identity-agent, vendir, nuclei, run...

CVE-2026-73845

CKAN MCP Server before v0.4.112 is affected by an allowlist bypass in the isValidMqaServer check within the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools (src/tools/quality.ts). The prefix-only regex for dati.gov.it allows suffix-host and URL-userinfo values to target an attacker-co...

CVE-2026-73845 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...

GO-2023-2331 vulnerabilities

Vulnerabilities for packages: temporal-server-fips, kubernetes, temporal, prometheus-adapter, volume-modifier-for-k8s, kubescape, aws-ebs-csi-driver, metrics-server-fips, envoy-ratelimit, k3s, kubernetes-csi-external-resizer, rancher-webhook-fips, docker-compose, rancher-webhook, kubevela,...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: zot, aws-otel-collector, aws-otel-collector-fips, nerdctl, docker-compose-fips, cg, opentelemetry-collector, buildkitd-fips, tw, kargo, elastic-agent, dagger, grype-db, trivy, falcoctl, grype-fips, openfga-fips, opentelemetry-collector-fips, zarf, prometheus,...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: grafana-alloy, k8sgpt, redpanda, opentelemetry-collector-contrib, weaviate, k3s, witness, terragrunt, dgraph, tempo, loki, rclone, opentelemetry-collector, cri-tools, eksctl, prometheus, terraform-mcp-server, dagger, lazygit, vcluster, datadog-agent, nfpm,...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, k8s-device-plugin, local-static-provisioner, argocd-image-updater, kubernetes-csi-driver-hostpath, cri-tools, kubeflow-pipelines, kubernetes-dns-node-cache, spark-operator, ip-masq-agent...

GO-2024-2737 vulnerabilities

Vulnerabilities for packages: wolfictl, k3d, melange, helm-push, docker-compose, policy-controller, neuvector-scanner, cri-tools, grype, buf, kaniko, docker, dagger, harbor-scanner-trivy, syft...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: k8sgpt, cerbos, wal-g, k3s, spark-operator, kind, docker-credential-gcr, opa, cloud-sql-proxy, docker-cli, dgraph, pluto, tempo, kapp-controller, nri-memcached, terraform-mcp-server, thanos-operator, clickhouse-operator, cloud-provider-gcp-cloud-controller-manager,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: policy-controller, slsa-verifier, zarf, skaffold, flux-source-controller, tkn, ko, aactl, melange, zot, gitsign, kubescape, neuvector-sigstore-interface, tekton-chains, wolfictl, goreleaser, apko, vexctl, spire-server, falcoctl...

vulnerabilities handled in Microsoft Developer Tools

Microsoft has identified vulnerabilities in various Developer Tools. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage, as listed in the table below. For successful exploitation, the malicious individual must deceive victims into importing and...

EUVD-2026-56180

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However...

CVE-2026-66772

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-58243

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

CVE-2026-66772

CVE-2026-66772 concerns SAP BusinessObjects BI Platform (Admin Tools), where a missing authorization check on certain administrative functionality lets an authenticated non-administrative user bypass restrictions to glean limited information about the affected feature. The impact is described as ...

EUVD-2026-55884

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

EUVD-2026-55873

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

CVE-2026-58243

The CVE-2026-58243 entry concerns SAP ABAP Development Tools failing to perform necessary authorization checks for certain functionality, enabling a low-privilege attacker to perform unauthorized database operations on SAP NetWeaver AS ABAP. The issue can lead to reading and modifying sensitive d...

PT-2026-70073

Name of the Vulnerable Software and Affected Versions Axis Signed Video Framework affected versions not specified Description The Signed Video Framework contains a buffer overflow issue, which occurs when a program writes more data to a block of memory than it can hold. This flaw can cause...