CVE-2026-42561 vulnerabilities

Vulnerabilities for packages: semgrep, airflow, reflex...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, thingsboard, apache-nifi-registry, zipkin...

CVE-2026-41506

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha....

CVE-2026-43322

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix UAF in lereadfeaturescomplete This fixes the following backtrace caused by hciconn being freed before lereadfeaturescomplete but after hcilereadremotefeaturessync so hciconndel - hcicmdsyncdequeue is not...

GHSA-FF6C-W6QF-7XQC vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2026-43286

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed global reservations to subpool Commit a833a693a490 "mm: hugetlb: fix incorrect fallback for subpool" fixed an underflow error for hstate-resvhugepages caused by incorrectly attributing globally requeste...

GHSA-MJ4R-2HFC-F8P6 vulnerabilities

Vulnerabilities for packages: zipkin, apicurio-registry, opensearch, docker-selenium, infinispan, kserve-modelmesh, neo4j, druid, wildfly, spark, selenium, apache-pulsar, apache-nifi, trino, cassandra, apache-activemq-artemis, sonarqube, tez, thingsboard, keycloak, zookeeper,...

GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: ztunnel, linkerd2-proxy, shadowsocks-rust, deno, vector...

GHSA-M4CV-J2PX-7723 vulnerabilities

Vulnerabilities for packages: zipkin, apicurio-registry, opensearch, docker-selenium, infinispan, kserve-modelmesh, neo4j, druid, spark, selenium, apache-pulsar, apache-nifi, trino, apache-activemq-artemis, sonarqube, tez, thingsboard, keycloak, strimzi-kafka-operator, akhq,...

GHSA-HF2P-G3JQ-W2MX vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu...

GHSA-P5WW-JRFV-82QX vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu-rc, linux-qemu...

CVE-2026-31696 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-gcp, linux-azure, linux-qemu-rc, linux-qemu...

GHSA-P3HW-MV63-RF9W vulnerabilities

Vulnerabilities for packages: cargo-audit, cargo-c, jujutsu...

GHSA-PG4W-G64P-QWHJ vulnerabilities

Vulnerabilities for packages: cargo-audit, cargo-c, jujutsu...

SUSE CVE-2026-7936

Determined not a vulnerability...

GHSA-9VQF-7F2P-GF9V vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, librechat, wazuh-dashboard, kibana...

GHSA-69XW-7HCM-H432 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, librechat, wazuh-dashboard, kibana...

CVE-2026-39817

The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem...

CVE-2026-42225

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, on GnuTLS builds, the SIP TLS transport siptransporttls can accept connections with invalid or untrusted certificates even when the application explicitly enables certificate verification via...

CVE-2026-39817

The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem...