A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key.
### Evidence
**pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names**
```go
func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) {
f.mu.Lock()
defer f.mu.Unlock()
result := []fs.FileInfo{}
for _, im := range f.images {
result = append(result, im)
}
return result, nil
}
func (f *imageFileSystem) Open(name string) (http.File, error) {
f.log.Info("Open", "path", name)
if name == "/" {
return f, nil
}
...
```
**cmd/controller/main.go — file server bound on all interfaces without auth or TLS**
```go
http.Handle("/", http.FileServer(imageServer.FileSystem()))
go func() {
server := &http.Server{
Addr: imagesBindAddr, // default ":8084"
ReadHeaderTimeout: 5 * time.Second,
}
err := server.ListenAndServe()
```
**pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image**
```go
func (b *ignitionBuilder) authFile() ignition_config_types_32.File {
source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret)
return ignition_config_types_32.File{
Node: ignition_config_types_32.Node{Path: "/etc/authfile.json"},
...
```
### Attack Pattern
Adjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.
CVE-2026-121524 is a SQL injection vulnerability in the sumiie24 School-Management-System affecting the parent_Login.php file within the Public Search Feature. The flaw allows remote attackers to manipulate the 'email' argument to execute SQL injection attacks. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The vendor was contacted but did not respond. Exploit code has been published. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.
An incorrect authorization vulnerability in the Blink component of Google Chrome prior to version 156.0.8078.47 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This vulnerability has been assigned a high severity level by Chromium security. The issue is fixed in Chrome version 156.0.8078.47.
Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-119084 is a high-severity vulnerability in the Amazon Redshift JDBC Driver before version 2.3.0. It involves unsafe reflection in handling connection parameters and AWS credentials profiles, which could allow an attacker who can influence these inputs to execute arbitrary code within the application context if a suitable class is present on the classpath. AWS has fixed this issue in version 2.3.0 and later.
Etrel INCH AC charging station management web interface versions prior to 7.1.2 and 8.0.1 contain a hard-coded default credentials vulnerability. This flaw allows remote attackers to gain full Administrator access by authenticating with factory-default credentials over unencrypted HTTP. Exploitation enables unauthorized administrative control, including access to charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details.
CVE-2026-121621 is a command injection vulnerability in Argo CD Image Updater used by Red Hat OpenShift GitOps. It occurs because a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker who can set a malicious proxy value may inject shell metacharacters to execute arbitrary commands and access credentials within the Image Updater process context.
CVE-2026-121517 is a heap-based buffer overflow vulnerability in IrfanView 4.76.0.0 on Win64, specifically in the TIFF Wang Annotation Handler component. The vulnerability can be triggered remotely but requires high attack complexity and is difficult to exploit. The vendor notes that the TIF-Annotations option is off by default, reducing exposure for normal users and classifying the danger level as low. Public exploit code exists, but no widespread exploitation is reported. The CVSS 4.0 score is 2.3, indicating low severity.
CVE-2026-111751 is a high-severity vulnerability in Angular versions 21.2.0 through 21.2.24 and 22.0.0 through 22.2.0. It involves uncontrolled resource consumption during Node.js server-side rendering when RouterLink directives retain computed UrlTree instances containing attacker-controlled query parameters. This can lead to excessive memory use and termination of the SSR worker. The issue is fixed in Angular versions 21.2.25 and 22.2.1.
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for protocol-relative URLs before WHATWG URL normalization. A request path containing a popping dot segment followed by multiple slashes can bypass the raw resolveUrl check and normalize to a pathname beginning with two slashes. When Angular SSR detects a mismatch with the router's final location, it can place that pathname in an HTTP Location header, causing a browser to navigate to an attacker-controlled origin. Affected applications use @angular/platform-server and @angular/ssr and either expose compatible parameter or child route shapes or pass user-controlled navigation targets through infrastructure that preserves the relevant dot segments or semicolons. Pure client-side SPAs are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker with access to the user's email account can follow the reset flow and bypass the additional authentication factor. CMS 6 is not affected. This issue is fixed in version 6.0.0.
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-64672 is a vulnerability in terragrunt versions prior to 1.1.1 where the catalog command follows a symlink in a predictable temporary directory. A local attacker with write access to the temporary directory can redirect operations to delete and replace directories outside the intended root, but exploitation requires local access and user interaction. This issue is fixed in version 1.1.1.
An improper input validation vulnerability in the Editing component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy via a crafted HTML page, leveraging social engineering techniques. The vulnerability has been assigned a low severity rating by Chromium security.
An incorrect authorization vulnerability in TrustedTypes in Google Chrome prior to version 157.0.8103.38 allowed a remote attacker to bypass the web origin policy using a crafted HTML page. The issue was assigned a low severity by Chromium security and has been fixed in version 157.0.8103.38.