Complete feed
Security advisories & CVEs
3242 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-58043] Node.js Vulnerability in NetApp Products
Node.js versions 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-44517] Build breakout via malicious Git repository or tar archive
Build breakout via malicious Git repository or tar archive. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-22. Affected products named by the advisory: Red Hat Certification Program for Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; and 4 more. Affected products named by the advisory: Red Hat OpenStack Platform 18.0; Red Hat Quay 3; Red Hat package: buildah; Red Hat package: podman.
Medium [CVE-2026-59654] Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service (DoS) scenario for the management server. This issue affects Apache CloudStack: from 4.7.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Medium [CVE-2026-59296] Line-protocol and log injection via unsanitized input allows metric and log spoofing
Line-protocol and log injection via unsanitized input allows metric and log spoofing. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-93. Affected products named by the advisory: Exploit Intelligence; Red Hat AMQ Broker 7; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; and 9 more. Affected products named by the advisory: Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat Build of Keycloak; Red Hat build of Quarkus; and 5 more.
Medium [CVE-2026-59323] Spring Boot: application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of s…
An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers. Specifically, an application is vulnerable when all the following are true: - W3C propagation is active (either configured manually or active by default, such as in Spring Boot 3.x+). - Baggage propagation is enabled (which is the default in Spring Boot 3.x+) and a baggage manager (such as BraveBaggageManager) is configured to handle baggage fields. - The application processes requests or messages from untrusted sources with baggage headers which it normally should not, see:. - Network components including the (HTTP) server that receives the request do not limit the header size or the limit is high enough to cause issues. The last two points are very important: normally this should not affect applications because they should not receive untrusted and unlimited input for baggage. When extracting baggage from the W3C baggage header, incoming entries are parsed without enforcing limits on the number of entries or header size as mandated by the W3C Baggage specification. An attacker can send requests or messages with artificially inflated baggage headers containing many key-value pairs, causing unconditional BaggageField allocations per entry.
Medium [CVE-2026-61399] Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Medium [CVE-2026-61422] Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validation is performed. However, this does not pose a malicious template or ISO registration risk, as URL validation still occurs prior to the actual download by the Secondary Storage VM.This issue affects Apache CloudStack: in 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Medium [CVE-2026-65613] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Medium [CVE-2026-66797] Apache CloudStack: Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Medium [CVE-2026-74866] @fastify/busboy: @fastify/busboy: CRLF injection via multipart Content-Disposition filename and name
@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix. A remote attacker could exploit this by uploading a file with a specially crafted filename or field name, leading to control character injection. An attacker can inject CRLF characters into multipart form data, which may be passed through to downstream HTTP responses or headers if the application reflects the parsed filename or name values without additional sanitization, potentially enabling HTTP response splitting or header injection.
Medium [CVE-2026-77679] path traversal in WebExtension XPI extraction (ZIP slip)
path traversal in WebExtension XPI extraction (ZIP slip). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-22.
Medium [CVE-2026-22695] Libpng Vulnerability in NetApp Products
Libpng versions 1.6.51 prior to 1.6.54 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-58218] Samba Vulnerability in NetApp Products
Samba versions 4.0 and higher are susceptible to a vulnerability which when successfully exploited could allow an unauthenticated user to practically block the use of DNS TSIG signing by repeatedly registering TKEY names, flooding a cache and causing legitimate TKEYs to be expunged. Successful exploitation of this vulnerability could lead to Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-58216] Samba Vulnerability in NetApp Products
Samba versions 4.0 and higher are susceptible to a vulnerability which when successfully exploited could lead to decryption failure and an error message or a server process crash. Successful exploitation of this vulnerability could lead to Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-60589 +2] August 2026 Java SE Vulnerabilities in NetApp Products
Java SE versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2 are susceptible to vulnerabilities that allow unauthenticated attackers with network access via multiple protocols (including HTTP and TLS) to compromise Oracle Java SE. Refer to “Oracle Critical Security Patch Update Advisory - August 2026” for additional details. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized access to critical data or complete access to all Oracle Java SE accessible data or unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Affected products: Data Infrastructure Insights and Data Secure Storage Workload Security Agent. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-71073 +2] August 2026 MySQL Connector/ODBC Vulnerabilities in NetApp Products
MySQL Connector/ODBC version 26.7.0 is susceptible to vulnerabilities that allow low privileged or unauthenticated attackers with network access via multiple protocols or logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Refer to “Oracle Critical Security Patch Update Advisory - August 2026” for additional details. Successful attacks of these vulnerabilities can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors and unauthorized read access to a subset of MySQL Connectors accessible data. NetApp states there is no workaround available at this time.
Medium [CVE-2026-1245] Node.js Vulnerability in NetApp Products
Node.js versions prior to 2.3.0 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-73282] OpenSSH Vulnerability in NetApp Products
OpenSSH versions through 10.4 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Low [CVE-2026-66721] Apache CloudStack: Missing authorization issue for domain admins in CloudStack's host tags listing functionality
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain. This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Low [CVE-2026-73283] OpenSSH Vulnerability in NetApp Products
OpenSSH versions through 10.4 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.