31 matches found
CLEANSTART-2026-IV23706 Security fixes in kube-state-metrics 2.19.1-r0
Package kube-state-metrics version 2.19.1-r0 fixes 2 vulnerabilities: CVE-2026-42505, CVE-2026-39822...
CVE-2026-66723 Missing authentication requirement in Remote Instances proxy API in MWDB Core
MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...
CVE-2026-66723
CVE-2026-66723 affects MWDB Core versions 2.2.0 up to but not including 2.19.0. The Vulnerability: Remote Instances proxy API fails to verify authentication for incoming requests, allowing an unauthenticated remote attacker to perform actions on a remote MWDB instance using the API key’s identity...
CVE-2026-66723 Missing authentication requirement in Remote Instances proxy API in MWDB Core
MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...
CVE-2026-66724
MWDB Core versions 2.0.0 to 2.18.x contain a missing authorization vulnerability in deprecated config and blob upload endpoints. The undocumented POST method bypasses capability checks that apply to the documented PUT method, allowing any authenticated user without adding_configs or adding_blobs ...
PT-2026-61721
Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.19.0 Apache MINA SSHD versions prior to 3.0.0-M5 Description Improper input validation in the sshd-git component of Apache MINA SSHD, specifically within the GitPgmCommandFactory, allows an authenticated SS...
Important: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-1 Update
Custom Metrics Autoscaler Operator for Red Hat OpenShift updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...
BIRD 安全漏洞
BIRD is a full-featured dynamic IP routing daemon developed by BIRD OpenSource. Versions of BIRD prior to 2.19.0 contained security vulnerabilities; these vulnerabilities stemmed from stack buffer overflows in the BGP ASPATH mask matching implementation, which could potentially cause the daemon t...
Astra Linux – Vulnerability in ruby-loofah
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.2.0; versions before 2.19.1 use recursion to sanitize CDATA sections. This can lead to stack exhaustion and raise a SystemStackError exception, potentially causing ...
Medium: lcms2
Issue Overview: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. CVE-2026-41254 Little CMS lcms2 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c. CVE-2026-42798 Affected...
CVE-2025-69297
Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aardvark Plugin: from n/a through = 2.19...
CVE-2025-69297
Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aardvark Plugin: from n/a through = 2.19...
WordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Spectra versions = 2.19.17...
CVE-2025-66398
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...
EUVD-2025-206139
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding...
CVE-2025-69203 Signal K Server Vulnerable to Access Request Spoofing
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against...
CVE-2025-68272
Summary: Signal K Server up to version 2.19.0 is affected by a DoS via unrestricted access request flooding at the endpoint /signalk/v1/access/requests. The issue arises from unbounded in-memory storage of access requests, leading to a JavaScript heap out of memory and server crash when handling ...
CVE-2025-67623 WordPress 6Storage Rentals plugin <= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through = 2.22.0...
CVE-2025-57352
CVE-2025-57352 affects the min-document package prior to 2.19.0 and is a prototype pollution issue via removeAttributeNS, triggered by input involving proto . IBM confirms affected products in connected bulletins: IBM Business Automation Workflow (containers and traditional), IBM Concert Software...