Skip to content
Fencer Intel

All · bitnami

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-48743 Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length
    bitnami
  2. 5.9
    CVE-2026-48497 Envoy: Abnormal process termination in DNS UDP filter
    bitnami
  3. 7.5
    CVE-2026-48044 Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
    bitnami
  4. 7.5
    CVE-2026-48042 Envoy: Stack overflow in destructor of highly nested JSON
    bitnami
  5. 4.4
    CVE-2026-47778 Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)
    bitnami
  6. 6.8
    CVE-2026-47775 Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption
    bitnami
  7. 7.2
    CVE-2026-44161 Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`
    rubygemsbitnami
  8. 7.5
    CVE-2026-44160 Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
    rubygemsbitnami
  9. 7.5
    CVE-2026-44025 Fluentd: Exposure of Sensitive Information via Monitor Agent API
    rubygemsbitnami
  10. 9.8
    CVE-2026-44024 Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
    rubygemsbitnami
    EPSS 1.1% chance of exploitation in 30 days, percentile 65%
  11. 5.6
    CVE-2026-48930 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation…
    Node.jsbitnami
  12. 4.2
    CVE-2026-48928 A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
    Node.jsbitnami
  13. 4.3
    CVE-2026-48934 A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
    Node.jsbitnami
  14. 3.3
    CVE-2026-48936 A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permissi…
    Node.jsbitnami
  15. 7.7
    CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypa…
    Node.jsbitnami
    EPSS 3.1% chance of exploitation in 30 days, percentile 88%
  16. 7.5
    CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.
    Node.jsbitnami
    EPSS 3.7% chance of exploitation in 30 days, percentile 89%
  17. 3.3
    CVE-2026-48935 A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.
    Node.jsbitnami
  18. 5.3
    CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on…
    Node.jsbitnami
  19. 5.9
    CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
    Node.jsbitnami
  20. 8.1
    CVE-2026-11800 Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion
    mavenbitnami
  21. 10.0
    CVE-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
    gobitnami
    EPSS 1.6% chance of exploitation in 30 days, percentile 76%
  22. 4.9
    CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
    mavenbitnami
  23. 4.6
    CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass
    mavenbitnami
  24. 6.5
    CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
    mavenbitnami
  25. 7.3
    CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
    mavenbitnami
  26. 7.7
    CVE-2026-9099 Keycloak: group-admin escalation to realm-admin
    bitnami
  27. 8.1
    CVE-2026-9800 Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison
    mavenbitnami
  28. 8.7
    CVE-2026-10086 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
    GitLabbitnami
  29. 3.8
    CVE-2026-0934 Incorrect Authorization in GitLab
    GitLabbitnami
  30. 4.3
    CVE-2026-1606 Improper Control of Generation of Code ('Code Injection') in GitLab
    GitLabbitnami