VulniPulse uses Google Ads measurement to understand visits from advertisements and campaign performance. It runs cookie-free until you choose — accepting enables cookies for more accurate attribution. Rejecting keeps it cookie-free and never limits the site.
See exactly what is measuredComplete feed
1702 advisories across 32 monitored vendors.
Cross-site scripting via incomplete URL scheme filtering. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79.
HTTP request smuggling via bare line-feed sequences in HTTP headers. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-444.
Denial of Service via crafted Markdown input. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1333.
Cross-Site Scripting via unescaped HTML class attribute in Admonition directive. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79.
Arbitrary code execution through crafted Markdown links. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79.
Same-page navigation redirection due to predictable heading IDs. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-79.
MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD). Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-1025.
CVE-2026-0281 PAN-OS: Information Disclosure Vulnerability in Management Web Interface
CVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities
CVE-2026-0276 Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
CVE-2026-0280 PAN-OS: IPv6 Firewall Policy Bypass
CVE-2026-0282 PAN-OS: File Deletion Vulnerability in Management Web Interface
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. A flaw was found in the `crypto/tls` package in Go. The vulnerability stems from the unintentional exposure of pre-shared key identities within the unencrypted client hello, potentially enabling an attacker to link previously anonymous connections. This primarily affects the privacy of communications rather than integrity or availability. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-201. Affected products named by the advisory: Assisted Installer for Red Hat OpenShift Container Platform 2; cert-manager Operator for Red Hat OpenShift; Compliance Operator; Confidential Compute Attestation; and 36 more.
AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails, and timestamps of private pages they lack access to. A flaw was found in AFFiNE. This vulnerability allows an authenticated workspace member to bypass document read permissions by supplying arbitrary document Globally Unique Identifiers (GUIDs) to the histories GraphQL field. This Moderate impact information disclosure flaw in AFFiNE allows authenticated workspace members to bypass document read permissions. This issue primarily affects deployments of AFFiNE and does not directly impact Red Hat products. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-639. Red Hat lists Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI) as not affected.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5. A flaw was found in protobufjs. An attacker could exploit this to alter object behavior, potentially leading to information disclosure or other impacts. This Moderate-impact flaw in protobufjs allows an attacker to perform prototype pollution by providing specially crafted input to the Text Format extension. Red Hat severity: Moderate — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-915. Under investigation: Cryostat 4; OpenShift Pipelines; OpenShift Service Mesh 3; Red Hat Ansible Automation Platform 2; Red Hat Build of Podman Desktop; Red Hat Ceph Storage 9; Red Hat Developer Hub; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4; Red Hat Openshift Data Foundation 4; Self-service automation portal 2. Red Hat lists Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images as not affected.
Denial of Service due to incorrect PAX path handling. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-843.
Denial of Service via crafted archive with NUL bytes in metadata. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-170.
Arbitrary IPMI command execution via send_raw deployment step. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-862.
Remote code execution or denial of service via use-after-free race condition. Red Hat rates this moderate (CVSS 5.6). Weakness: CWE-364.
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. A flaw was found in OpenSSH's SSH daemon (sshd). A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attacker to guess valid credentials, potentially leading to unauthorized access or a denial of service. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-307. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:37382.