207785 matches found
automation-controller: automation-controller-container: automation-controller: missing use_role authorization on the project signature validation credential foreign key allows a project administrator to bind and use another organization's credential cross-tenant
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. A project has a signature validation credential foreign key used to validate signed project content. Unlike the project's SCM credential, the authorization logic does not verify that the requesting user has use...
automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via Schedule/WorkflowJobTemplateNode survey min/max validation error message
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification,...
automation-controller: automation-controller-container: automation-controller: missing use_role authorization on the project signature validation credential foreign key allows a project administrator to bind and use another organization's credential cross-tenant
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. A project has a signature validation credential foreign key used to validate signed project content. Unlike the project's SCM credential, the authorization logic does not verify that the requesting user has use...
postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp
A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the...
EUVD-2026-85656
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...
CVE-2026-67405
RabbitMQ messaging and streaming broker is vulnerable to a Cross-Site WebSocket Hijacking (CSWSH) flaw in its Web-MQTT and Web-STOMP handlers. The vulnerability exists because these handlers fail to validate the Origin header during a WebSocket upgrade. If non-default configurations are enabled—s...
WordPress YOP Poll plugin <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability
Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin YOP Poll versions = 7.0.10...
CVE-2026-84714
A flaw was found in the automation-controller input-validation guard sanitizejinja. The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '' or '%' character, so a Jinja expression containing an inner brace for example an empty dict i...
CVE-2026-84643
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. A project has a signature validation credential foreign key used to validate signed project content. Unlike the project's SCM credential, the authorization logic does not verify that the requesting user has use...
CVE-2026-84499 Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification,...
CVE-2026-84499 Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification,...
EUVD-2026-85541
LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...
CVE-2026-71464 Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard
LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...
CVE-2026-71464
The Red Hat Ansible Automation Platform (specifically the automation-controller ) contains a vulnerability in the LaunchConfigurationBaseSerializer.scm_branch component. The root cause is a missing validate_scm_branch() leading-dash check, which allows Schedule and WFJT Node to accept malicious i...
CVE-2026-71464
LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...
EUVD-2026-44813
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding...
podman security update
An update is available for podman. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The podman tool manages pods, container images, and containers. It is part of...
RLSA-2026:70201 Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint...
CVE-2026-71300
A flaw was found in Apache Camel Atmosphere Websocket. This improper input validation vulnerability allows a remote attacker to inject specific Exchange headers, such as websocket.connectionKey.list, which are not properly filtered. By manipulating these headers, an attacker can take control of t...
CVE-2026-65583
A flaw was found in Apache CXF. The OpenID Connect OIDC relying-party token validation in Apache CXF could accept specially crafted self-issued ID tokens. This bypasses necessary claim checks, such as issuer, subject, audience, and time, leading to an authentication bypass. This vulnerability...