https://vulnerability.circl.lu Latest vulnerabilities published by the CNAs operating under the redhat root of the CVE Program. http://www.rssboard.org/rss-specification python-feedgen en Tue, 18 Aug 2026 17:18:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75924 Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval https://vulnerability.circl.lu/vuln/cve-2026-75924 Tue, 18 Aug 2026 16:27:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-71365 Awx: webhook status callback ssrf leaks the git pat Awx: webhook status callback ssrf leaks the git pat https://vulnerability.circl.lu/vuln/cve-2026-71365 Tue, 18 Aug 2026 15:51:10 +0000 https://vulnerability.circl.lu/vuln/cve-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf https://vulnerability.circl.lu/vuln/cve-2026-12564 Tue, 18 Aug 2026 15:50:54 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75485 Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of proxy basic-auth credentials Must-gather: must-gather: cluster proxy object dumped raw, bypassing inspect redaction of proxy basic-auth credentials https://vulnerability.circl.lu/vuln/cve-2026-75485 Tue, 18 Aug 2026 15:15:42 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73834 Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction https://vulnerability.circl.lu/vuln/cve-2026-73834 Tue, 18 Aug 2026 15:15:38 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66793 Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke https://vulnerability.circl.lu/vuln/cve-2026-66793 Tue, 18 Aug 2026 15:02:31 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75032 Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder https://vulnerability.circl.lu/vuln/cve-2026-75032 Tue, 18 Aug 2026 14:33:47 +0000 https://vulnerability.circl.lu/vuln/cve-2026-19608 Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies https://vulnerability.circl.lu/vuln/cve-2026-19608 Tue, 18 Aug 2026 11:08:20 +0000 https://vulnerability.circl.lu/vuln/cve-2026-66795 Managedcluster-import-controller: managedcluster-import-controller: csr auto-approver does not validate certificate subject, signername, or requester identity Managedcluster-import-controller: managedcluster-import-controller: csr auto-approver does not validate certificate subject, signername, or requester identity https://vulnerability.circl.lu/vuln/cve-2026-66795 Mon, 17 Aug 2026 20:45:33 +0000 https://vulnerability.circl.lu/vuln/cve-2026-71472 Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem https://vulnerability.circl.lu/vuln/cve-2026-71472 Mon, 17 Aug 2026 19:28:43 +0000