| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-93017 | 7.7 | The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: | 2026-11-13 14:18:23 | 2026-10-08 15:17:56 |
| CVE-2026-92824 | 6.2 | A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata wi | 2026-11-13 14:18:22 | 2026-10-21 04:18:12 |
| CVE-2026-92823 | 6.2 | A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a high | 2026-11-13 14:18:20 | 2026-10-21 04:18:12 |
| CVE-2026-92822 | 6.2 | A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafte | 2026-11-13 14:18:07 | 2026-10-21 04:18:11 |
| CVE-2026-92558 | - | The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a d | 2026-11-13 14:18:04 | 2026-11-10 22:21:15 |
| CVE-2026-92241 | 5.7 | The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in subsys/bluetooth/host/classic/avrcp.c, allocated from the shared avctp_browsing_rx_pool with K_FOREVER. L2CAP invokes that callback from the Bluetooth RX | 2026-11-13 14:18:03 | 2026-11-13 14:18:01 |
| CVE-2026-92443 | - | The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers. | 2026-11-13 14:18:03 | 2026-11-10 22:21:15 |
| CVE-2026-91094 | - | A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fai | 2026-11-13 14:18:01 | 2026-11-13 14:18:01 |
| CVE-2026-90834 | 5.5 | The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the wrong driver operation. z_vrfy_uart_poll_out_u16(), z_vrfy_uart_tx_u16() and z_vrfy_uart_rx_enable_u16() each ran K_SYSCALL_DRIVER_U | 2026-11-13 14:18:01 | 2026-11-10 22:21:14 |
| CVE-2026-90833 | 7.8 | The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with a single test, (offset + len) <= config->size. Because offset is a signed off_t and len an unsigned size_t of the same rank, the a | 2026-11-13 14:18:01 | 2026-11-10 22:21:14 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: