29881 matches found
SUSE CVE-2026-71403
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's username and principalIds fields. A user holding the update verb on users.management.cattle.io could inject a foreign identity provider principal into any account, so that the next log...
SUSE CVE-2026-71404
A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable authz.management.cattle.io/cr-name annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could...
SUSE CVE-2026-75033
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...
SUSE CVE-2026-75034
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a...
SUSE CVE-2026-75035
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...
CGA-4P3H-4JGV-VX3W
Bulletin has no description...
CVE-2026-40204
None None None No publicly available exploits are known...
CVE-2026-40018
None None None No publicly available exploits are known...
MINI-C89P-R8P2-Q2FX
Bulletin has no description...
MINI-78QW-P46F-477W
Bulletin has no description...
MINI-4H6F-W827-GRVG
Bulletin has no description...
MINI-V5F8-4G3V-2M4V
Bulletin has no description...
MINI-QXMW-6GQR-9V5F
Bulletin has no description...
Exploit.Malware-Development
No d...
CVE-2026-40204
None None None No publicly available exploits are known...
DEBIAN-CVE-2026-80699
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit a...
DEBIAN-CVE-2026-80680
In the Linux kernel, the following vulnerability has been resolved: i2c: amd-mp2: Unregister callback on adapter add failure amdmp2registercb stores the platform I2C context in the MP2 PCI driver's callback table before the adapter is registered. If i2caddadapter fails, probe returns and devres...
DEBIAN-CVE-2026-80652
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
DEBIAN-CVE-2026-80624
In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a...