A TraceQL query in Grafana Tempo with a large exemplars hint value can cause the Tempo instance to allocate an excessive amount of memory, resulting in an out-of-memory crash. This could allow an authenticated user to trigger a denial of service against the Tempo service.
CVE-2026-55686 is a vulnerability in Podman versions prior to 5.7.1 where a malicious container image using a WORKDIR path containing a symlink can cause directory creation or ownership modification on the host filesystem. This occurs due to symlink traversal during container startup, potentially allowing a container to affect host directories such as /var/BREAKOUT. The issue was fixed in Podman 5.7.1.
ZITADEL's external JWT Identity Provider implementation has a vulnerability where tokens missing the 'iat' (issued at) claim bypass the token freshness check, allowing reuse of arbitrarily old tokens. This flaw affects versions 3.0.0 through 3.4.11 and 4.0.0 through 4.15.1. The issue is fixed in versions 3.4.12 and 4.15.2, which reject tokens lacking the 'iat' claim. Without the 'iat' claim, the maximum age freshness validation is skipped, compromising session integrity.
Zitadel OAuth2/OIDC implementations in versions 3.0.0 through 3.4.11 and 4.0.0 through 4.15.1 omit client_id binding during authorization code exchange and refresh token flows, violating RFC 6749 Section 4.1.3. This allows an attacker who intercepts authorization codes or refresh tokens to use them with a different client identity, potentially gaining unauthorized access. Exploitation requires prior compromise or token theft in the application environment. PKCE mitigates some risks for authorization code injection but not refresh token misuse. The issue is fixed in versions 3.4.12 and 4.15.2 and later.
A high severity vulnerability in Traefik's domain-fronting protection (SNICheck) allows an unauthenticated client to bypass mutual TLS enforcement when wildcard TLSOptions are used. The issue arises because SNICheck resolves TLS options for HTTP Host headers using exact matches only, ignoring wildcard mappings. This enables an attacker to complete a TLS handshake under permissive options and then send an HTTP Host header targeting a wildcard-protected backend, bypassing client certificate requirements. The vulnerability affects HTTPS and HTTP/2 traffic and does not require HTTP/3. A fix is available in Traefik version 3.7.3 and later.
A vulnerability in Fleet v4 prior to 4.84.2 allowed authenticated users with Observer-level privileges to extract sensitive host enrollment secrets via an unvalidated ORDER BY parameter in the labels host-listing API endpoint. This flaw enabled a binary search oracle attack on sensitive columns such as node_key and orbit_node_key, which are long-lived secrets used by osquery and Orbit agents for authentication. Exploitation requires Observer role access, and exposed secrets could allow impersonation of hosts and manipulation of Fleet data. A patch is available in version 4.84.2.
A vulnerability in nebula-mesh (up to version 0.3.6) causes decrypted CA private keys to remain in process memory after use. The CA private key is not zeroized after signing operations, allowing it to persist in the heap until garbage collection occurs. This exposure risks memory-read attacks such as core dumps, ptrace, or container snapshots. The issue is fixed in version 0.3.7.
CVE-2026-53476 is a critical path traversal vulnerability in the assisted-migration-agent component. An unauthenticated attacker on the same LAN can craft a malicious gzipped tarball to bypass security checks and write arbitrary files, potentially leading to unauthorized code execution on the appliance. Red Hat has assessed that this vulnerability does not affect any currently supported Red Hat products.
CVE-2026-53475 is a critical vulnerability in the assisted-migration-agent application caused by improper TLS certificate validation when communicating with vCenter. This flaw allows a Man-in-the-Middle (MITM) attacker to intercept and steal vCenter administrator credentials, potentially leading to unauthorized access to vCenter environments. The vulnerability has a CVSS score of 9.3. According to the vendor advisory, this issue does not affect any currently supported Red Hat products. No specific affected versions or patches are detailed in the advisory at this time.
CVE-2026-53474 is a critical SQL Injection vulnerability in migration-planner that allows a remote authenticated attacker to execute malicious SQL by uploading a specially crafted RVTools .xlsx file. This flaw enables arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and credentials, which could lead to full compromise of the SaaS environment. The vulnerability affects versions prior to 0.13.5. Red Hat has assessed that this vulnerability does not impact any currently supported Red Hat products. A patch is available to address this issue.
CVE-2026-53471 is a critical authorization bypass vulnerability in migration-planner. The agent-API middleware fails to validate the source_id claim in JSON Web Tokens (JWTs) against the requested source ID in certain handlers. This flaw allows an authenticated attacker with a valid agent token to manipulate data across different tenants, breaking tenant isolation. Potential impacts include unauthorized overwriting of inventory, planting malicious credential URLs, or corrupting migration assessments. Red Hat has assessed that this vulnerability does not affect any currently supported Red Hat product. A patch is available for affected versions prior to 0.13.5.
CVE-2026-53470 is a critical authorization bypass vulnerability in the migration-planner cloud service affecting versions prior to 0.13.5. An authenticated attacker can exploit improper access control in the /api/v1/sources/{id}/image-url endpoint to bypass ownership checks and obtain presigned S3 URLs for OVA images belonging to other users. These images may contain sensitive data such as long-lived agent JWTs and source configurations, potentially enabling unauthorized access and modification of victim sources. A patch is available, and the vendor manages remediation for this cloud-hosted service.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.
CVE-2026-34033 is a medium severity vulnerability in Apache Answer affecting versions before 2.0.1. It involves improper neutralization of script-related HTML tags (basic XSS) where user-supplied content is included in notification emails without proper escaping. This allows authenticated users to inject arbitrary HTML into emails sent to other users. The issue is fixed in Apache Answer version 2.0.1.
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to unintended external requests and tracking by third-party servers.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.
A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.