<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <id>https://vulnerability.circl.lu/rss/recent/all/10</id>
  <title>Most recent entries from all</title>
  <updated>2026-10-01T16:31:05.971120+00:00</updated>
  <author>
    <name>Vulnerability-Lookup</name>
    <email>info@circl.lu</email>
  </author>
  <link href="https://vulnerability.circl.lu" rel="alternate"/>
  <generator uri="https://lkiesow.github.io/python-feedgen" version="1.0.0">python-feedgen</generator>
  <subtitle>Contains only the most 10 recent entries.</subtitle>
  <entry>
    <id>https://vulnerability.circl.lu/vuln/cve-2026-71465</id>
    <title>CVE-2026-71465 — Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli ar…</title>
    <updated>2026-10-01T16:31:05.974074+00:00</updated>
    <content type="xhtml">
      <div xmlns="http://www.w3.org/1999/xhtml"><p><strong>Affected:</strong> Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7</p>
<p>RunAdHocCommand.build_args() appends limit as bare
              positional (args.append(limit)) instead of using
              args.extend(['-l', limit]) like RunJob. A limit beginning
              with - is parsed as an ansible CLI option. Currently
              limited to short-circuit flags (--version, --help) since
              injected element displaces required pattern positional.
              Would escalate if ansible-core ever defaults pattern.</p></div>
    </content>
    <link href="https://vulnerability.circl.lu/vuln/cve-2026-71465"/>
  </entry>
</feed>
