Threats Tagged 'cve-2026-60413'

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-60413 is a high-severity vulnerability in Oracle Outside In Technology version 8.5.8. It allows an unauthenticated attacker with logon access to the infrastructure where the product executes to compromise it. Exploitation requires human interaction from a user other than the attacker and can lead to full takeover of the Oracle Outside In Technology component. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.8. Oracle has published a Critical Security Patch Update advisory covering this and many other vulnerabilities but does not explicitly confirm a patch for this specific version in the advisory content provided.