agentprime: red-hat-ansible-automation-platform-2-7Every new CVE for red-hat-ansible-automation-platform-2-7.https://agentprime.io/CVE-2026-92982: Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionhttps://agentprime.io/advisories/CVE-2026-92982/https://agentprime.io/advisories/CVE-2026-92982/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 15:36:57 GMTCVECVE-2026-90959: Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key thefthttps://agentprime.io/advisories/CVE-2026-90959/https://agentprime.io/advisories/CVE-2026-90959/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 14:49:10 GMTCVECVE-2026-94416: Aap-gateway: aap-gateway: authorization bypass via workload identity token forgeryhttps://agentprime.io/advisories/CVE-2026-94416/https://agentprime.io/advisories/CVE-2026-94416/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 12:25:11 GMTCVECVE-2026-84724: Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage processhttps://agentprime.io/advisories/CVE-2026-84724/https://agentprime.io/advisories/CVE-2026-84724/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:42 GMTCVECVE-2026-84721: Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)https://agentprime.io/advisories/CVE-2026-84721/https://agentprime.io/advisories/CVE-2026-84721/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:38 GMTCVECVE-2026-84720: Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oraclehttps://agentprime.io/advisories/CVE-2026-84720/https://agentprime.io/advisories/CVE-2026-84720/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:36 GMTCVECVE-2026-84718: Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trusthttps://agentprime.io/advisories/CVE-2026-84718/https://agentprime.io/advisories/CVE-2026-84718/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:33 GMTCVECVE-2026-84717: Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templateshttps://agentprime.io/advisories/CVE-2026-84717/https://agentprime.io/advisories/CVE-2026-84717/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:32 GMTCVECVE-2026-84716: Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnameshttps://agentprime.io/advisories/CVE-2026-84716/https://agentprime.io/advisories/CVE-2026-84716/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:28 GMTCVECVE-2026-84713: Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter ora…https://agentprime.io/advisories/CVE-2026-84713/https://agentprime.io/advisories/CVE-2026-84713/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:26 GMTCVECVE-2026-84712: Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membershiphttps://agentprime.io/advisories/CVE-2026-84712/https://agentprime.io/advisories/CVE-2026-84712/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:22 GMTCVECVE-2026-85475: Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslo…https://agentprime.io/advisories/CVE-2026-85475/https://agentprime.io/advisories/CVE-2026-85475/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:11 GMTCVECVE-2026-84719: Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)https://agentprime.io/advisories/CVE-2026-84719/https://agentprime.io/advisories/CVE-2026-84719/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:07 GMTCVEcriticalCVE-2026-84714: Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-co…https://agentprime.io/advisories/CVE-2026-84714/https://agentprime.io/advisories/CVE-2026-84714/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:06 GMTCVECVE-2026-84706: Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution i…https://agentprime.io/advisories/CVE-2026-84706/https://agentprime.io/advisories/CVE-2026-84706/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:39:57 GMTCVECVE-2026-75884: Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupshttps://agentprime.io/advisories/CVE-2026-75884/https://agentprime.io/advisories/CVE-2026-75884/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:39:52 GMTCVEcriticalCVE-2026-84691: Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admi…https://agentprime.io/advisories/CVE-2026-84691/https://agentprime.io/advisories/CVE-2026-84691/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:02:26 GMTCVECVE-2026-84683: Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…https://agentprime.io/advisories/CVE-2026-84683/https://agentprime.io/advisories/CVE-2026-84683/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:02:18 GMTCVECVE-2026-84499: Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error m…https://agentprime.io/advisories/CVE-2026-84499/https://agentprime.io/advisories/CVE-2026-84499/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:47:54 GMTCVECVE-2026-84502: Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podhttps://agentprime.io/advisories/CVE-2026-84502/https://agentprime.io/advisories/CVE-2026-84502/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:47:26 GMTCVEcriticalCVE-2026-84474: Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…https://agentprime.io/advisories/CVE-2026-84474/https://agentprime.io/advisories/CVE-2026-84474/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:41:18 GMTCVEcriticalCVE-2026-84486: Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation…https://agentprime.io/advisories/CVE-2026-84486/https://agentprime.io/advisories/CVE-2026-84486/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:35:50 GMTCVECVE-2026-71465: Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executablehttps://agentprime.io/advisories/CVE-2026-71465/https://agentprime.io/advisories/CVE-2026-71465/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:29:05 GMTCVECVE-2026-71464: Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guardhttps://agentprime.io/advisories/CVE-2026-71464/https://agentprime.io/advisories/CVE-2026-71464/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:29:02 GMTCVECVE-2026-71463: Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebackshttps://agentprime.io/advisories/CVE-2026-71463/https://agentprime.io/advisories/CVE-2026-71463/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:28:59 GMTCVECVE-2026-71462: Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control podhttps://agentprime.io/advisories/CVE-2026-71462/https://agentprime.io/advisories/CVE-2026-71462/CVSS 4.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:25:22 GMTCVECVE-2026-71461: Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handlerhttps://agentprime.io/advisories/CVE-2026-71461/https://agentprime.io/advisories/CVE-2026-71461/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:25:16 GMTCVECVE-2026-71460: Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/https://agentprime.io/advisories/CVE-2026-71460/https://agentprime.io/advisories/CVE-2026-71460/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:25:11 GMTCVECVE-2026-76648: Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recoveryhttps://agentprime.io/advisories/CVE-2026-76648/https://agentprime.io/advisories/CVE-2026-76648/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:24:44 GMTCVECVE-2026-71459: Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structurehttps://agentprime.io/advisories/CVE-2026-71459/https://agentprime.io/advisories/CVE-2026-71459/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:08:04 GMTCVECVE-2026-71458: Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumerationhttps://agentprime.io/advisories/CVE-2026-71458/https://agentprime.io/advisories/CVE-2026-71458/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:07:58 GMTCVECVE-2026-84470: Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorizatio…https://agentprime.io/advisories/CVE-2026-84470/https://agentprime.io/advisories/CVE-2026-84470/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 20:57:09 GMTCVECVE-2026-71366: Awx: notification backends allow ssrf and credential leakagehttps://agentprime.io/advisories/CVE-2026-71366/https://agentprime.io/advisories/CVE-2026-71366/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Aug 2026 15:42:44 GMTCVECVE-2026-71364: Awx: project archive extraction allows path traversal file writeshttps://agentprime.io/advisories/CVE-2026-71364/https://agentprime.io/advisories/CVE-2026-71364/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Aug 2026 15:21:54 GMTCVECVE-2026-71365: Awx: webhook status callback ssrf leaks the git pathttps://agentprime.io/advisories/CVE-2026-71365/https://agentprime.io/advisories/CVE-2026-71365/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:51:10 GMTCVECVE-2026-12564: Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfhttps://agentprime.io/advisories/CVE-2026-12564/https://agentprime.io/advisories/CVE-2026-12564/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:50:54 GMTCVEcriticalCVE-2026-18141: Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http headerhttps://agentprime.io/advisories/CVE-2026-18141/https://agentprime.io/advisories/CVE-2026-18141/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 15:34:16 GMTCVECVE-2026-12383: Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dnhttps://agentprime.io/advisories/CVE-2026-12383/https://agentprime.io/advisories/CVE-2026-12383/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 19:12:29 GMTCVECVE-2026-12701: Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexporthttps://agentprime.io/advisories/CVE-2026-12701/https://agentprime.io/advisories/CVE-2026-12701/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:18:18 GMTCVEcriticalCVE-2026-12382: Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofinghttps://agentprime.io/advisories/CVE-2026-12382/https://agentprime.io/advisories/CVE-2026-12382/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 17:21:28 GMTCVECVE-2026-11807: Eda-server: websocket missing authorization allows credential theft via activation_id spoofinghttps://agentprime.io/advisories/CVE-2026-11807/https://agentprime.io/advisories/CVE-2026-11807/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 19:40:33 GMTCVEcriticalCVE-2026-44188: Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationhttps://agentprime.io/advisories/CVE-2026-44188/https://agentprime.io/advisories/CVE-2026-44188/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 15 Jun 2026 08:36:06 GMTCVECVE-2025-57847: Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionshttps://agentprime.io/advisories/CVE-2025-57847/https://agentprime.io/advisories/CVE-2025-57847/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 13:55:00 GMTCVE