https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:50:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-375162 EUVD-2026-375162 https://cve.radiocsirt.org/vuln/euvd-2026-375162 https://cve.radiocsirt.org/vuln/fkie_cve-2026-84718 <p>A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request&#39;s client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller&#39;s audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.</p> <p>A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request&#39;s client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller&#39;s audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-84718 https://cve.radiocsirt.org/vuln/ghsa-fxxq-29xm-f392 <p>A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request&#39;s client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller&#39;s audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.</p> <p>A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request&#39;s client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller&#39;s audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.</p> https://cve.radiocsirt.org/vuln/ghsa-fxxq-29xm-f392 https://cve.radiocsirt.org/vuln/rhsa-2026:71113 <p>Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nanoid: nanoid: Denial of Service via negative size input in non-secure module functions gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Command Injection via Git option prefix abbreviation postcss: PostCSS: Information disclosure via crafted sourceMappingURL automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enable…</p> <p>Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages js-yaml: js-yaml: Denial of Service via crafted YAML documents sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nanoid: nanoid: Denial of Service via negative size input in non-secure module functions gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Command Injection via Git option prefix abbreviation postcss: PostCSS: Information disclosure via crafted sourceMappingURL automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enable…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:71113 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3555 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3555