Export limit exceeded: 24258 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (24258 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-53682 | 1 Redhat | 3 Certificate System, Dogtag Certificate System, Enterprise Linux | 2026-09-23 | 5.3 Medium |
| An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session. | ||||
| CVE-2024-24786 | 1 Redhat | 23 Acm, Ceph Storage, Cluster Observability Operator and 20 more | 2026-09-23 | 7.5 High |
| The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set. | ||||
| CVE-2026-6857 | 1 Redhat | 9 Apache Camel Spring Boot, Build Of Apache Camel For Quarkus, Build Of Apache Camel For Spring Boot and 6 more | 2026-09-23 | 7.5 High |
| A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability. | ||||
| CVE-2025-6170 | 2 Redhat, Xmlsoft | 11 Discovery, Enterprise Linux, Enterprise Linux Eus and 8 more | 2026-09-23 | 2.5 Low |
| A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections. | ||||
| CVE-2026-95503 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-09-23 | 6.8 Medium |
| A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts. | ||||
| CVE-2026-95511 | 2 Cups, Redhat | 3 Cups, Enterprise Linux, Hardened Images | 2026-09-23 | 8.2 High |
| Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed. | ||||
| CVE-2026-95619 | 1 Redhat | 5 Enterprise Linux, Hardened Images, Hummingbird and 2 more | 2026-09-23 | 7.7 High |
| A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability. | ||||
| CVE-2026-90462 | 2 Redhat, Sssd | 4 Enterprise Linux, Openshift, Openshift Container Platform and 1 more | 2026-09-23 | 5.4 Medium |
| A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available. | ||||
| CVE-2024-1300 | 1 Redhat | 21 A Mq Clients, Amq Broker, Amq Streams and 18 more | 2026-09-23 | 5.4 Medium |
| A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error. | ||||
| CVE-2024-1023 | 1 Redhat | 21 A Mq Clients, Amq Broker, Amq Streams and 18 more | 2026-09-23 | 6.5 Medium |
| A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak. | ||||
| CVE-2026-84684 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 9.6 Critical |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a source inventory to a constructed inventory through the input_inventories relationship endpoint, the controller verifies only that the requesting user can read the source inventory, rather than that they hold use permission on it, unlike instance group attachment on the same access class. An authenticated user who can administer a constructed inventory and has read-only visibility of an inventory in another organization -- for example an organization or system auditor -- can attach that foreign inventory as an input. On synchronization the controller clones every host and host variable, including secrets, into the attacker's inventory, and because the attacker administers the constructed inventory they can run ad hoc commands against the cloned hosts, resulting in cross-tenant disclosure of inventory data and secrets and code execution against another tenant's managed hosts. | ||||
| CVE-2026-84703 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 6.8 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates only the organization and the credential kind. An authenticated user who is an execution-environment admin of one organization can associate a container registry credential belonging to a different organization -- one they cannot otherwise read, list, or use -- to an execution environment they control. When a job runs with that execution environment, the controller decrypts the foreign credential's registry password and supplies it to the container runtime, disclosing another organization's registry credentials across the tenant boundary. | ||||
| CVE-2026-84707 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 6.5 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The host_filter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relations it traverses. Because job event and ad-hoc command output fields are not on that blocklist, an authenticated user holding only the Read role on an inventory can construct filters that traverse into the output of jobs they have no permission to view and use the returned host count as a boolean oracle. Using regular-expression lookups, the attacker can extract, character by character, the output (which routinely contains plaintext credentials, tokens, and command results) of jobs and ad-hoc commands belonging to other organizations, resulting in cross-tenant disclosure of job output | ||||
| CVE-2026-84686 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 7.6 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Notification template password fields are encrypted with a key derived from the secret key, the object primary key, and the field name, but not the subfield name, and the API returns the full ciphertext of a password subfield after the notification type is changed to one that does not define that subfield. A user with administrative access to a single notification template, but without any wider privilege, can switch the template type to reveal the stored ciphertext, replant that ciphertext into a webhook password field pointing at a server they control, and trigger a test notification. The controller decrypts the replayed ciphertext to the original plaintext and sends it to the attacker's server in an HTTP Basic authorization header, allowing recovery of Slack, PagerDuty, Twilio, AWS SNS, and Grafana credentials the administrator was only permitted to use, not read. | ||||
| CVE-2026-84711 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 9.9 Critical |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a `git checkout`/`git fetch` command line as bare arguments with no end-of-options separator. An authenticated user permitted to create or edit a project can set the SCM branch to a git option such as `--pathspec-from-file=<path>`, causing git to read an arbitrary file on the synchronization host and reflect its contents back through the project-update output. Because project synchronization runs on the control-plane host on default OpenShift Operator deployments, an attacker can read the control-plane Kubernetes ServiceAccount token, the Controller SECRET_KEY, and the database credentials, leading to full compromise of the Automation Platform and its Kubernetes namespace. System administrator privileges are not required and the impact crosses tenants. | ||||
| CVE-2026-84644 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 7.4 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Thycotic Secret Server external credential plugin passes a user-supplied server URL to its SDK without validating the scheme, host, or IP range, and the plugin backend is executed synchronously within the automation controller web process. Using the external credential test endpoint, a user who holds only the use role on such a credential can override the stored server URL with an arbitrary internal address, causing the control plane to issue requests to internal services. Although the response is a generic error, response timing reveals whether internal hosts and ports are reachable, enabling internal network reconnaissance and a blind request-forgery primitive from the control plane, and each request can hold a web worker, affecting availability. | ||||
| CVE-2026-84692 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 8.5 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the incoming one, and a node can be created without a unified job template. An authenticated user who holds admin permission on a single workflow job template can create an empty node and then patch it to reference any job template, project, inventory source, system job, or workflow on the platform -- including ones in other organizations that they cannot otherwise read or launch. Running their own workflow then executes the victim template with the victim's attached credentials, inventory and project, resulting in cross-organization privilege escalation to arbitrary automation execution. The patch response also discloses the victim template's name and description. | ||||
| CVE-2026-84689 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 8.5 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job -- writable and does not include it in the permission validation performed for the other node fields. An authenticated user with permission to execute a single job template can submit a bulk job launch whose node references the identifier of any unified job in any organization, including jobs they cannot access. The node then exposes that job's metadata, and cancelling the attacker's workflow cancels the referenced job through the workflow cancellation cascade, without any per-job authorization check. Repeated, this allows a low-privileged user to cancel running jobs, project and inventory syncs, ad hoc commands, and system jobs across all organizations, denying automation service platform-wide. | ||||
| CVE-2026-84680 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 4.1 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a Galaxy or Automation Hub credential to an organization through the galaxy_credentials relationship endpoint, the controller verifies only that the requesting user can read the credential, rather than that they hold use permission on it, unlike other credential consumption in the product. An authenticated user who administers one organization and has read-only visibility of a credential in another organization -- for example a platform auditor -- can bind that foreign credential to their own organization. On the next project synchronization the controller decrypts the credential server-side and uses its token to authenticate to the credential owner's Automation Hub, allowing cross-tenant use of another organization's secret. | ||||
| CVE-2026-84643 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 5.0 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. A project has a signature validation credential foreign key used to validate signed project content. Unlike the project's SCM credential, the authorization logic does not verify that the requesting user has use permission on the referenced credential, and the API field has no validator or type restriction. An authenticated user holding only the organization project administrator role can therefore bind an arbitrary credential belonging to another organization, by its identifier, when creating or updating a project. The controller discloses that credential's name and type in the project's summary information and, during project synchronization, decrypts the bound credential and uses it in the attacker-controlled project's update, allowing a cross-tenant authorization boundary violation and information disclosure. | ||||