https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:54:35.569350+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-377312 EUVD-2026-377312 2026-10-02T15:54:35.582847+00:00 EUVD-2026-377312 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71461 fkie_cve-2026-71461 2026-10-02T15:54:35.582882+00:00

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.

 https://cve.radiocsirt.org/vuln/ghsa-98xv-m2v4-crqh GHSA-98xv-m2v4-crqh 2026-10-02T15:54:35.582917+00:00

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.

 https://cve.radiocsirt.org/vuln/rhsa-2026:71177 RHSA-2026:71177 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update 2026-10-02T15:54:35.582936+00:00

ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing sqlparse: sqlparse: Denial of Service via inefficient SQL parsing automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enables cross-tenant resource name enumeration automation-controller: automation-controller-container: automation-controller: JobJobEventsChildrenSummary RBAC bypass exposes cross-tenant job event tree structure automation-controller: automation-controller-container: automation-controller: Any authenticated user reads Red Hat subscription/license details via /config/ automation-controller: automation-controller-container: automation-controller: Verbose internal exception disclosure via HostList bare-Exception handler automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on co…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3555 WID-SEC-W-2026-3555 — Red Hat Ansible Automation Platform (automation-controller): Mehrere Schwachstellen 2026-10-02T15:54:35.583043+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.