| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0. |
| privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges |
| Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. |
| Use after free in SQL Server allows an authorized attacker to execute code over a network. |
| Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
| A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data. |
| Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network. |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation.
This issue affects JetFormBuilder: from n/a through 3.6.1. |
| A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information. |
| In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: linearize skbuff for packet generation
batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() is not only
called (indirectly) by the unsharing+linearizing batadv_recv_mcast_packet()
handler. When it is called (indirectly) by batadv_mcast_forw_mcsend() then
it will be unshared but not linearized. The SKB_LINEAR_ASSERT() can
therefore cause a fatal BUG().
The linearization should happen during the expansion of the head because
the scrape function can be hit already during the initial
batadv_mcast_forw_mode() selection code:
* batadv_interface_tx
* batadv_mcast_forw_mode
* batadv_mcast_forw_mode_by_count()
* batadv_mcast_forw_push()
-> calls batadv_mcast_forw_expand_head() before everything else
* batadv_mcast_forw_push_tvlvs()
* batadv_mcast_forw_push_dests()
* batadv_mcast_forw_push_adjust_padding()
* batadv_mcast_forw_scrape() |
| In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Free init resources if kvm_init() fails
kvm_loongarch_init() calls kvm_loongarch_env_init() to allocate the
per-CPU kvm_context (vmcs) and kvm_loongarch_ops and to register the
perf callbacks, and then calls kvm_init(). If kvm_init() fails its
result is returned directly, but since module_init() does not run the
module_exit() stuff on failure, so kvm_loongarch_env_exit() is never
called and those resources are leaked.
So call kvm_loongarch_env_exit() when kvm_init() fails, matching the
teardown-on-failure pattern used by riscv_kvm_init(). |
