The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the test-render (stub has small job.id). At runtime, the gated branch executes and exceptions write full tracebacks into notification body, which is POSTed to attacker-controlled webhook URL. Leaks install paths, Python version, source line numbers.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade receptorUpgrade python3.12-django-ansible-base+redis_clientUpgrade python3.12-django-ansible-base+rest_filtersUpgrade automation-controller-serverUpgrade automation-controller-venv-towerUpgrade automation-controller-cliUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-eda-controller-base-servicesUpgrade automation-controllerUpgrade automation-gateway-proxy-serverUpgrade automation-gateway-proxyUpgrade receptorctlUpgrade automation-gatewayUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-controller-uiUpgrade automation-gateway-proxy-server-debuginfoUpgrade automation-eda-controller-baseUpgrade python3-sqlparseUpgrade python3.12-django-ansible-baseUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-eda-controller-event-stream-servicesUpgrade python3.12-gitpython | Sep 25, 2026 | Sep 6, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub