Search
Search Results (326098 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-7195 | 1 Redhat | 13 Acm, Advanced Cluster Security, Apicurio Registry and 10 more | 2026-01-03 | 5.2 Medium |
| Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. | ||||
| CVE-2026-21652 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21651 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21650 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21649 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21648 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21647 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21646 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21645 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21644 | 2026-01-03 | N/A | ||
| Not used | ||||
| CVE-2026-21484 | 2026-01-03 | 5.3 Medium | ||
| AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue. | ||||
| CVE-2025-64125 | 2026-01-03 | N/A | ||
| A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End users do not have to take any action to mitigate the issue. | ||||
| CVE-2025-64124 | 2026-01-03 | N/A | ||
| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): before 2.5.1. | ||||
| CVE-2025-64123 | 2026-01-03 | N/A | ||
| Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): through and including release 2.5.1. | ||||
| CVE-2025-69031 | 2026-01-02 | 5.3 Medium | ||
| Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6. | ||||
| CVE-2025-69030 | 2026-01-02 | 5.4 Medium | ||
| Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3. | ||||
| CVE-2025-69029 | 2026-01-02 | 5.4 Medium | ||
| Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Struktur: from n/a through <= 2.5.1. | ||||
| CVE-2025-69028 | 2026-01-02 | 5.3 Medium | ||
| Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25. | ||||
| CVE-2025-69027 | 2026-01-02 | 5.4 Medium | ||
| Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0. | ||||
| CVE-2025-69026 | 2026-01-02 | 4.3 Medium | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue affects PopupKit: from n/a through <= 2.1.5. | ||||