HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-75887 — A flaw was found in the OpenShift console. An unauthenticated attacker can explo...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against

Analysis

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends. CVSS Score: 7.5. Published: 2026-09-23T22:16:57.117.

Indicators of Compromise (1)

CVE (1)
CVE-2026-75887
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 23, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-102911 — A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknow...

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is

CVE-2026-102911
NIST NVD
MEDIUMVulnerability

Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development

The accord opened the door to future regulation but focused on four voluntary steps for the companies to take. The post Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

NVD CRITICAL: CVE-2026-103056 — AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in ...

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitr

CVE-2026-103056
NIST NVD