Threats Tagged 'cve-2026-33377'

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The 1.5.2 release of COO.

Red Hat Advanced Cluster Management for Kubernetes version 2.13.11 includes a security update addressing multiple vulnerabilities. The update provides new features, enhancements, bug fixes, and updated container images. The advisory rates the security impact as Important (high severity). No known exploits are reported in the wild. Users should apply this update after ensuring all previous relevant errata are applied.

Red Hat Advanced Cluster Management for Kubernetes versions 2.17.0 up to but not including 2.17.1 contain multiple security vulnerabilities addressed in the 2.17.1 update. This update includes security fixes, bug fixes, and updated container images. The vulnerabilities affect the management of Kubernetes clusters and applications from a single console with built-in security policies. The update is rated as having an important security impact by Red Hat Product Security.

Red Hat issued a critical security advisory for Multicluster Global Hub version 1.4.8, which is a component set enabling management of multiple hub clusters from a single hub cluster. The advisory addresses multiple vulnerabilities identified by CVE identifiers including CVE-2026-33376. The update includes security fixes and updated container images. No explicit patch details are provided in the advisory text, but the update to version 1.4.8 is the security fix. No known exploits are reported in the wild.

Multiple security vulnerabilities have been identified and fixed in Grafana as packaged for Red Hat Enterprise Linux 10. These include privilege escalation via dashboard overwrite, unauthorized access due to an incorrect IPv6 allow-list default in the Auth Proxy, and denial of service through unbounded memory growth in the OAuth login route and excessive memory allocation from large API request payloads. Red Hat has released updates addressing these issues in Grafana version 10.2.6 and related packages.

The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.