Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

5 result(s)

Export this search: RSS · CSV · STIX

CVE-2026-85469 High · 8.0 CWE-1357 Sep 16, 2026

Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.

CVE-2026-67275 Medium · 6.5 CWE-1357 Aug 26, 2026

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently…

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning.

CVE-2026-75569 High · 7.7 CWE-1357 Aug 19, 2026

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.

CVE-2026-66783 Medium · 4.4 CWE-1357 Aug 18, 2026

Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref

A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.

CVE-2026-47619 High · 8.1 CWE-1357 Aug 4, 2026

NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker…

NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.