Total
65 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-26393 | 2026-06-17 | N/A | 5.4 MEDIUM | ||
| SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, leading to unauthorized data manipulation. | |||||
| CVE-2025-24986 | 1 Microsoft | 2 Azure Promptflow Core, Azure Promptflow Tools | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2025-21590 | 1 Juniper | 1 Junos | 2026-06-17 | N/A | 4.4 MEDIUM |
| An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS: * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R1-S2, 24.2R2. | |||||
| CVE-2025-20109 | 2026-06-17 | N/A | 7.8 HIGH | ||
| Improper Isolation or Compartmentalization in the stream cache mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access. | |||||
| CVE-2025-1974 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) | |||||
| CVE-2025-12805 | 1 Redhat | 1 Openshift Ai | 2026-06-17 | N/A | 8.1 HIGH |
| A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the llama-stack service endpoint. As a result, a user in one namespace can access another user’s Llama Stack instance and potentially view or manipulate sensitive data. | |||||
| CVE-2025-12695 | 2026-06-17 | N/A | 5.9 MEDIUM | ||
| The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class. | |||||
| CVE-2024-8118 | 2026-06-17 | N/A | N/A | ||
| In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules. | |||||
| CVE-2024-5801 | 2026-06-17 | N/A | N/A | ||
| Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based packets through the host, potentially by-passing firewall, router, or NAC filtering. | |||||
| CVE-2024-57723 | 1 Sammycage | 1 Lunasvg | 2026-06-17 | N/A | 6.5 MEDIUM |
| lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over. | |||||
| CVE-2024-57721 | 1 Sammycage | 1 Lunasvg | 2026-06-17 | N/A | 6.5 MEDIUM |
| lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path. | |||||
| CVE-2024-57720 | 1 Sammycage | 1 Lunasvg | 2026-06-17 | N/A | 6.5 MEDIUM |
| lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend. | |||||
| CVE-2024-55456 | 1 Sammycage | 1 Lunasvg | 2026-06-17 | N/A | 6.5 MEDIUM |
| lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell | |||||
| CVE-2024-53855 | 1 Nofusscomputing | 1 Centurion Erp | 2026-06-17 | N/A | 1.9 LOW |
| Centurion ERP (Enterprise Rescource Planning) is a simple application developed to provide open source IT management with a large emphasis on the IT Service Management (ITSM) modules. A user who is authenticated and has view permissions for a ticket, can view the tickets of another organization they are not apart of. Users with following permissions are applicable: 1. `view_ticket_change` permission can view change tickets from organizations they are not apart of. 2. `view_ticket_incident` permission can view incident tickets from organizations they are not apart of. 3. `view_ticket_request` permission can view request tickets from organizations they are not apart of. 4. `view_ticket_problem` permission can view problem tickets from organizations they are not apart of. The access to view the tickets from different organizations is only applicable when browsing the API endpoints for the tickets in question. The Centurion UI is not affected. Project Tasks, although a "ticket type" are also **Not** affected. This issue has been addressed in release version 1.3.1 and users are advised to upgrade. Users unable to upgrade may remove the ticket view permissions from users which would alleviate this vulnerability, if this is deemed not-viable, Upgrading is recommended. | |||||
| CVE-2024-49373 | 1 Nofusscomputing | 1 Centurion Erp | 2026-06-17 | N/A | 4.1 MEDIUM |
| No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects within organizations they are not apart of. Version 1.2.1 fixes the problem. | |||||
| CVE-2024-47520 | 1 Arista | 1 Ng Firewall | 2026-06-17 | N/A | 7.6 HIGH |
| A user with advanced report application access rights can perform actions for which they are not authorized | |||||
| CVE-2024-43803 | 2026-06-17 | N/A | 4.9 MEDIUM | ||
| The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the `userData`, `metaData`, and `networkData` for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the `Name` and `Namespace` of the Secret, meaning that versions of the baremetal-operator prior to 0.8.0, 0.6.2, and 0.5.2 will read a `Secret` from any namespace. A user with access to create or edit a `BareMetalHost` can thus exfiltrate a `Secret` from another namespace by using it as e.g. the `userData` for provisioning some host (note that this need not be a real host, it could be a VM somewhere). BMO will only read a key with the name `value` (or `userData`, `metaData`, or `networkData`), so that limits the exposure somewhat. `value` is probably a pretty common key though. Secrets used by _other_ `BareMetalHost`s in different namespaces are always vulnerable. It is probably relatively unusual for anyone other than cluster administrators to have RBAC access to create/edit a `BareMetalHost`. This vulnerability is only meaningful, if the cluster has users other than administrators and users' privileges are limited to their respective namespaces. The patch prevents BMO from accepting links to Secrets from other namespaces as BMH input. Any BMH configuration is only read from the same namespace only. The problem is patched in BMO releases v0.7.0, v0.6.2 and v0.5.2 and users should upgrade to those versions. Prior upgrading, duplicate the BMC Secrets to the namespace where the corresponding BMH is. After upgrade, remove the old Secrets. As a workaround, an operator can configure BMO RBAC to be namespace scoped for Secrets, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces. | |||||
| CVE-2024-35425 | 1 Lonelycoder | 1 Vmir | 2026-06-17 | N/A | 5.5 MEDIUM |
| vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c. | |||||
| CVE-2024-35281 | 1 Fortinet | 2 Forticlient, Fortifone Softclient | 2026-06-17 | N/A | 2.5 LOW |
| An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variables. | |||||
| CVE-2024-33768 | 1 Sammycage | 1 Lunasvg | 2026-06-17 | N/A | 9.8 CRITICAL |
| lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over. | |||||