Threats Tagged 'cve-2026-50162'

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing multiple vulnerabilities in the helm4 package version 4.2.3-0.1.2.hum1 for aarch64 and x86_64 architectures. The advisory highlights CVE-2026-63308 among other CVEs with a high severity rating. No newer patched version is explicitly stated, and no active exploitation in the wild has been reported. The update is relevant to Migration Toolkit for Virtualization components using this helm4 package version.

Red Hat has issued a security advisory for Red Hat Hardened Images including golang1.26 packages, addressing multiple vulnerabilities. The update provides new RPM packages for golang1.26 version 1.26.6-0.1.hum1 across various architectures. The advisory references several CVEs including CVE-2026-33818 and others. The update is classified as a security fix with high severity. No detailed technical information or exploitation details are provided in the advisory.

Red Hat issued a security advisory for Red Hat Edge Manager version 1.2.1 addressing multiple vulnerabilities including CVE-2026-6377. Red Hat Edge Manager is a solution for managing edge devices and container workloads, supporting scalable and security-focused lifecycle management. The advisory does not provide specific details on fixes or patches. The vulnerabilities are rated as high severity. No known exploits in the wild are reported. The advisory emphasizes the product's role in managing large-scale edge deployments but does not specify remediation steps or affected versions beyond those listed.

Red Hat has issued a security advisory for a bug fix and enhancement update to Red Hat Hardened Images RPMs, specifically updating the helm3 package to version 3.21.3-0.1.2.hum1 for aarch64 and x86_64 architectures. The advisory addresses multiple CVEs including CVE-2026-50162. The update is intended to fix security issues and improve the hardened images. No explicit details on the nature of the vulnerabilities or exploits in the wild are provided.

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.