agentprime: red-hat-ansible-automation-platform-2Every new CVE for red-hat-ansible-automation-platform-2.https://agentprime.io/CVE-2026-114236: Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layershttps://agentprime.io/advisories/CVE-2026-114236/https://agentprime.io/advisories/CVE-2026-114236/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 08:04:32 GMTCVECVE-2026-109131: Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)https://agentprime.io/advisories/CVE-2026-109131/https://agentprime.io/advisories/CVE-2026-109131/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 18:46:00 GMTCVECVE-2026-92982: Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionhttps://agentprime.io/advisories/CVE-2026-92982/https://agentprime.io/advisories/CVE-2026-92982/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 15:36:57 GMTCVECVE-2026-89091: Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionhttps://agentprime.io/advisories/CVE-2026-89091/https://agentprime.io/advisories/CVE-2026-89091/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 21:49:30 GMTCVECVE-2026-103869: Pulp-ansible: bearer tokens are reused across remotes in a workerhttps://agentprime.io/advisories/CVE-2026-103869/https://agentprime.io/advisories/CVE-2026-103869/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 05:46:15 GMTCVECVE-2026-103868: Pulp-container: registry credentials are reused across remotes in a workerhttps://agentprime.io/advisories/CVE-2026-103868/https://agentprime.io/advisories/CVE-2026-103868/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 05:46:12 GMTCVECVE-2026-106033: Ansible: ansible-ui: ansible ui dom xss in /redirect next parameterhttps://agentprime.io/advisories/CVE-2026-106033/https://agentprime.io/advisories/CVE-2026-106033/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 18:18:06 GMTCVECVE-2026-103754: Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directoryhttps://agentprime.io/advisories/CVE-2026-103754/https://agentprime.io/advisories/CVE-2026-103754/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 11:57:07 GMTCVECVE-2026-90959: Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key thefthttps://agentprime.io/advisories/CVE-2026-90959/https://agentprime.io/advisories/CVE-2026-90959/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 14:49:10 GMTCVECVE-2026-94416: Aap-gateway: aap-gateway: authorization bypass via workload identity token forgeryhttps://agentprime.io/advisories/CVE-2026-94416/https://agentprime.io/advisories/CVE-2026-94416/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 12:25:11 GMTCVECVE-2026-84721: Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)https://agentprime.io/advisories/CVE-2026-84721/https://agentprime.io/advisories/CVE-2026-84721/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:38 GMTCVECVE-2026-84713: Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter ora…https://agentprime.io/advisories/CVE-2026-84713/https://agentprime.io/advisories/CVE-2026-84713/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:26 GMTCVECVE-2026-85475: Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslo…https://agentprime.io/advisories/CVE-2026-85475/https://agentprime.io/advisories/CVE-2026-85475/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:11 GMTCVECVE-2026-71461: Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handlerhttps://agentprime.io/advisories/CVE-2026-71461/https://agentprime.io/advisories/CVE-2026-71461/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:25:16 GMTCVECVE-2026-76648: Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recoveryhttps://agentprime.io/advisories/CVE-2026-76648/https://agentprime.io/advisories/CVE-2026-76648/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:24:44 GMTCVECVE-2026-42784: Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusionhttps://agentprime.io/advisories/CVE-2026-42784/https://agentprime.io/advisories/CVE-2026-42784/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 16:56:11 GMTCVECVE-2026-92091: Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops arrayhttps://agentprime.io/advisories/CVE-2026-92091/https://agentprime.io/advisories/CVE-2026-92091/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 07:34:08 GMTCVECVE-2026-79699: Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directoryhttps://agentprime.io/advisories/CVE-2026-79699/https://agentprime.io/advisories/CVE-2026-79699/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:25:16 GMTCVECVE-2026-79705: Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callershttps://agentprime.io/advisories/CVE-2026-79705/https://agentprime.io/advisories/CVE-2026-79705/CVSS 4.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 16:23:26 GMTCVECVE-2026-84185: Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verificationhttps://agentprime.io/advisories/CVE-2026-84185/https://agentprime.io/advisories/CVE-2026-84185/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 20:46:40 GMTCVECVE-2026-84232: Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg contenthttps://agentprime.io/advisories/CVE-2026-84232/https://agentprime.io/advisories/CVE-2026-84232/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 15:18:59 GMTCVECVE-2026-80179: Jwcrypto: jwcrypto: denial of service via malformed jwe tokenshttps://agentprime.io/advisories/CVE-2026-80179/https://agentprime.io/advisories/CVE-2026-80179/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Aug 2026 21:14:23 GMTCVECVE-2026-79717: Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrictionhttps://agentprime.io/advisories/CVE-2026-79717/https://agentprime.io/advisories/CVE-2026-79717/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 14:53:45 GMTCVECVE-2026-18141: Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http headerhttps://agentprime.io/advisories/CVE-2026-18141/https://agentprime.io/advisories/CVE-2026-18141/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 15:34:16 GMTCVECVE-2026-44191: Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settingshttps://agentprime.io/advisories/CVE-2026-44191/https://agentprime.io/advisories/CVE-2026-44191/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2026 12:11:29 GMTCVECVE-2026-44187: Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api keyhttps://agentprime.io/advisories/CVE-2026-44187/https://agentprime.io/advisories/CVE-2026-44187/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2026 12:06:50 GMTCVECVE-2026-44192: Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversalhttps://agentprime.io/advisories/CVE-2026-44192/https://agentprime.io/advisories/CVE-2026-44192/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2026 12:06:48 GMTCVECVE-2026-44190: Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script settinghttps://agentprime.io/advisories/CVE-2026-44190/https://agentprime.io/advisories/CVE-2026-44190/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2026 12:06:42 GMTCVECVE-2026-44189: Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filenamehttps://agentprime.io/advisories/CVE-2026-44189/https://agentprime.io/advisories/CVE-2026-44189/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2026 12:06:36 GMTCVECVE-2026-16544: Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosurehttps://agentprime.io/advisories/CVE-2026-16544/https://agentprime.io/advisories/CVE-2026-16544/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Jul 2026 11:15:53 GMTCVECVE-2026-16493: Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)https://agentprime.io/advisories/CVE-2026-16493/https://agentprime.io/advisories/CVE-2026-16493/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Jul 2026 17:26:14 GMTCVECVE-2026-12701: Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexporthttps://agentprime.io/advisories/CVE-2026-12701/https://agentprime.io/advisories/CVE-2026-12701/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:18:18 GMTCVEcriticalCVE-2026-11807: Eda-server: websocket missing authorization allows credential theft via activation_id spoofinghttps://agentprime.io/advisories/CVE-2026-11807/https://agentprime.io/advisories/CVE-2026-11807/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 19:40:33 GMTCVEcriticalCVE-2026-12726: Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credentialhttps://agentprime.io/advisories/CVE-2026-12726/https://agentprime.io/advisories/CVE-2026-12726/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 18:49:55 GMTCVECVE-2026-44188: Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationhttps://agentprime.io/advisories/CVE-2026-44188/https://agentprime.io/advisories/CVE-2026-44188/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 15 Jun 2026 08:36:06 GMTCVECVE-2026-6494: Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized inputhttps://agentprime.io/advisories/CVE-2026-6494/https://agentprime.io/advisories/CVE-2026-6494/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 08:18:50 GMTCVECVE-2025-57847: Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionshttps://agentprime.io/advisories/CVE-2025-57847/https://agentprime.io/advisories/CVE-2025-57847/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 13:55:00 GMTCVECVE-2026-0598: Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apihttps://agentprime.io/advisories/CVE-2026-0598/https://agentprime.io/advisories/CVE-2026-0598/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Feb 2026 05:47:57 GMTCVECVE-2025-10894: Nx: nx/devkit: malicious versions of nx and plugins published to npmhttps://agentprime.io/advisories/CVE-2025-10894/https://agentprime.io/advisories/CVE-2025-10894/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Sep 2025 21:20:31 GMTCVEcriticalCVE-2025-53861: Aap: sensitive cookie(s) set without security flagshttps://agentprime.io/advisories/CVE-2025-53861/https://agentprime.io/advisories/CVE-2025-53861/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Jul 2025 12:44:17 GMTCVECVE-2025-53862: Aap: aap-gateway: automation-hub: sensitive information disclosurehttps://agentprime.io/advisories/CVE-2025-53862/https://agentprime.io/advisories/CVE-2025-53862/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Jul 2025 12:34:24 GMTCVECVE-2024-9620: Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryptionhttps://agentprime.io/advisories/CVE-2024-9620/https://agentprime.io/advisories/CVE-2024-9620/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Oct 2024 16:25:39 GMTCVECVE-2022-3205: Controller: cross site scripting in automation controller uihttps://agentprime.io/advisories/CVE-2022-3205/https://agentprime.io/advisories/CVE-2022-3205/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Sep 2022 19:19:46 GMTCVE