Export limit exceeded: 398203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (398203 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84707 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 6.5 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The host_filter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relations it traverses. Because job event and ad-hoc command output fields are not on that blocklist, an authenticated user holding only the Read role on an inventory can construct filters that traverse into the output of jobs they have no permission to view and use the returned host count as a boolean oracle. Using regular-expression lookups, the attacker can extract, character by character, the output (which routinely contains plaintext credentials, tokens, and command results) of jobs and ad-hoc commands belonging to other organizations, resulting in cross-tenant disclosure of job output | ||||
| CVE-2026-84686 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 7.6 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Notification template password fields are encrypted with a key derived from the secret key, the object primary key, and the field name, but not the subfield name, and the API returns the full ciphertext of a password subfield after the notification type is changed to one that does not define that subfield. A user with administrative access to a single notification template, but without any wider privilege, can switch the template type to reveal the stored ciphertext, replant that ciphertext into a webhook password field pointing at a server they control, and trigger a test notification. The controller decrypts the replayed ciphertext to the original plaintext and sends it to the attacker's server in an HTTP Basic authorization header, allowing recovery of Slack, PagerDuty, Twilio, AWS SNS, and Grafana credentials the administrator was only permitted to use, not read. | ||||
| CVE-2026-84711 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 9.9 Critical |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a `git checkout`/`git fetch` command line as bare arguments with no end-of-options separator. An authenticated user permitted to create or edit a project can set the SCM branch to a git option such as `--pathspec-from-file=<path>`, causing git to read an arbitrary file on the synchronization host and reflect its contents back through the project-update output. Because project synchronization runs on the control-plane host on default OpenShift Operator deployments, an attacker can read the control-plane Kubernetes ServiceAccount token, the Controller SECRET_KEY, and the database credentials, leading to full compromise of the Automation Platform and its Kubernetes namespace. System administrator privileges are not required and the impact crosses tenants. | ||||
| CVE-2026-84644 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 7.4 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Thycotic Secret Server external credential plugin passes a user-supplied server URL to its SDK without validating the scheme, host, or IP range, and the plugin backend is executed synchronously within the automation controller web process. Using the external credential test endpoint, a user who holds only the use role on such a credential can override the stored server URL with an arbitrary internal address, causing the control plane to issue requests to internal services. Although the response is a generic error, response timing reveals whether internal hosts and ports are reachable, enabling internal network reconnaissance and a blind request-forgery primitive from the control plane, and each request can hold a web worker, affecting availability. | ||||
| CVE-2026-84475 | 2026-09-23 | 7.7 High | ||
| automation-controller: InventorySource.source_vars lacks prevent_search, enabling zero-privilege cross-tenant extraction of inline inventory-plugin credentials via the credential_types FieldLookupBackend count-oracle | ||||
| CVE-2026-84692 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 8.5 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the incoming one, and a node can be created without a unified job template. An authenticated user who holds admin permission on a single workflow job template can create an empty node and then patch it to reference any job template, project, inventory source, system job, or workflow on the platform -- including ones in other organizations that they cannot otherwise read or launch. Running their own workflow then executes the victim template with the victim's attached credentials, inventory and project, resulting in cross-organization privilege escalation to arbitrary automation execution. The patch response also discloses the victim template's name and description. | ||||
| CVE-2026-84689 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 8.5 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job -- writable and does not include it in the permission validation performed for the other node fields. An authenticated user with permission to execute a single job template can submit a bulk job launch whose node references the identifier of any unified job in any organization, including jobs they cannot access. The node then exposes that job's metadata, and cancelling the attacker's workflow cancels the referenced job through the workflow cancellation cascade, without any per-job authorization check. Repeated, this allows a low-privileged user to cancel running jobs, project and inventory syncs, ad hoc commands, and system jobs across all organizations, denying automation service platform-wide. | ||||
| CVE-2026-84680 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 4.1 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a Galaxy or Automation Hub credential to an organization through the galaxy_credentials relationship endpoint, the controller verifies only that the requesting user can read the credential, rather than that they hold use permission on it, unlike other credential consumption in the product. An authenticated user who administers one organization and has read-only visibility of a credential in another organization -- for example a platform auditor -- can bind that foreign credential to their own organization. On the next project synchronization the controller decrypts the credential server-side and uses its token to authenticate to the credential owner's Automation Hub, allowing cross-tenant use of another organization's secret. | ||||
| CVE-2026-93676 | 1 Redhat | 1 Enterprise Linux | 2026-09-22 | 3.2 Low |
| xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications. | ||||
| CVE-2026-87766 | 1 Redhat | 3 Enterprise Linux, Hardened Images, Hummingbird | 2026-09-22 | 8.8 High |
| A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0. | ||||
| CVE-2026-95829 | 1 Tduckcloud | 1 Tduck-platform | 2026-09-22 | 6.3 Medium |
| A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue. | ||||
| CVE-2026-87136 | 1 Oracle | 1 Hyperion Data Relationship Management | 2026-09-22 | 7.5 High |
| Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-87137 | 1 Oracle | 1 Hyperion Data Relationship Management | 2026-09-22 | 7.6 High |
| Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). | ||||
| CVE-2026-87141 | 1 Oracle | 1 Hyperion Data Relationship Management | 2026-09-22 | 7.7 High |
| Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. While the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). | ||||
| CVE-2026-87144 | 1 Oracle | 1 Hyperion Data Relationship Management | 2026-09-22 | 7.6 High |
| Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hyperion Data Relationship Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). | ||||
| CVE-2025-62673 | 1 Tp-link | 2 Archer Ax53, Archer Ax53 Firmware | 2026-09-22 | 8.0 High |
| Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a maliciously formed field. This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120 and Archer AX12 v1.0: up to 1.5.1 Build 20260721. | ||||
| CVE-2026-93573 | 2 Io.netty, Redhat | 21 Netty-codec-http, Amq Broker, Amq Clients and 18 more | 2026-09-22 | 6.5 Medium |
| A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context. | ||||
| CVE-2026-88620 | 1 1024-lab | 1 Smartadmin | 2026-09-22 | 4.3 Medium |
| SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users | ||||
| CVE-2026-76699 | 1 Hewlett Packard Enterprise (hpe) | 1 Edgeconnect Sd-wan Gateways | 2026-09-22 | 6.4 Medium |
| A buffer overflow vulnerability exists in a system service within the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to cause a denial-of-service. Successful exploitation could allow an attacker to crash the impacted service and temporarily disrupting network operations. | ||||
| CVE-2026-76700 | 1 Hewlett Packard Enterprise (hpe) | 1 Edgeconnect Sd-wan Gateways | 2026-09-22 | 5.9 Medium |
| Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service. | ||||