https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:42:36 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-56097 <p>A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.</p> <p>A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-56097 https://vulnerability.circl.lu/vuln/ghsa-mmq3-mv36-wfm7 <p>A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.</p> <p>A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.</p> https://vulnerability.circl.lu/vuln/ghsa-mmq3-mv36-wfm7 https://vulnerability.circl.lu/vuln/rhsa-2026:74503 <p>rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter foreman: unauthenticated information disclosure via provisioning token validation flaw foreman: command injection in foreman-rake errors:fetch_log via request_id parameter foreman: command injection in foreman-rake database tasks foreman: command injection in foreman-tail foreman: SSTI and insecure deserialization in foreman-rake configuration rubygem-hammer_cli: command injection via insecure editor invocation dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header postcss: PostCSS: Information disclosure and denial of service via crafted CSS input sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing rubygem-katello: SQL injection in Registry Proxy via labels rubygem-katello: improper authorization logic allows resource enumeration html/template: golang: Go html/template: Cross-Site Scripting via pathological input net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations sqlparse: sqlparse: Denial of Service v…</p> <p>rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter foreman: unauthenticated information disclosure via provisioning token validation flaw foreman: command injection in foreman-rake errors:fetch_log via request_id parameter foreman: command injection in foreman-rake database tasks foreman: command injection in foreman-tail foreman: SSTI and insecure deserialization in foreman-rake configuration rubygem-hammer_cli: command injection via insecure editor invocation dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header postcss: PostCSS: Information disclosure and denial of service via crafted CSS input sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing rubygem-katello: SQL injection in Registry Proxy via labels rubygem-katello: improper authorization logic allows resource enumeration html/template: golang: Go html/template: Cross-Site Scripting via pathological input net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations sqlparse: sqlparse: Denial of Service v…</p> https://vulnerability.circl.lu/vuln/rhsa-2026:74503