Connected evidence
Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.
Saved searches 0
Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.
Threads
Related changes across sources- Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant Newly collected advisory: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs in github.com/kubeflow/pipelines5 linked entries across history · in Security Follow evidence and connection reasons
- Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory Newly collected advisory: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory in github.com/kubeflow/pipelines5 linked entries across history · in Security Follow evidence and connection reasons
- Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads Newly collected advisory: Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads in github.com/gofiber/fiber5 linked entries across history · in Security Follow evidence and connection reasons
- praktor: Telegram upload traversal permits persistent agent instruction injection Newly collected advisory: praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection) in github.com/mtzanidakis/praktor5 linked entries across history · in Security Follow evidence and connection reasons
- Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins Newly collected advisory4 linked entries across history · in Security Follow evidence and connection reasons
- knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion Newly collected advisory: Admission webhooks allow unbounded request-body memory exhaustion in knative.dev/pkg4 linked entries across history · in Security Follow evidence and connection reasons
- Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through Newly collected advisory: Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through4 linked entries across history · in Security Follow evidence and connection reasons
- Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware Newly collected advisory: Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware in github.com/daptin/daptin4 linked entries across history · in Security Follow evidence and connection reasons
- Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Gnutls: gnutls: information disclosure via heap overread in rsa key exchange Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Samba: access control bypass via vfs_ceph_rgw case-insensitive open Affected-version evidence changed4 linked entries across history · in Security Follow evidence and connection reasons
- Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Microsoft Purview: Data Loss Prevention - Data Security for non-Microsoft connected apps Date moved later5 linked entries across history · in Microsoft 365 Follow evidence and connection reasons
- System-preferred authentication Guidance changed4 linked entries across history · in Identity & APIs Follow evidence and connection reasons
- Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons