GHSA-J4FX-XXWH-2485 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu...

CVE-2026-14957

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-84331

Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

ROS-20260902-73-0003

The vulnerability in openbao is related to the use of a name with an incorrect reference. Exploiting this vulnerability can allow a perpetrator to cause a service failure...

CVE-2026-84349

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

go-fdo-server security update

1.0.1-4 - Rebuild go-fdo-server against updated golang 1.0.1-3 - Rebuild against updated golang...

ROS-20260902-73-0028

The vulnerability in ElasticSearch is related to an uncontrolled recursion. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2026-84308

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add and subtract. During the Montgomery ladder in...

CVE-2026-84120

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2026-84119

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

SUSE CVE-2026-49275

unknown...

chromium-browser: libyuv: chromium-browser: Heap buffer overflow in libyuv

A heap buffer overflow flaw was found in the libyuv component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514748734...

GHSA-GJHQ-GJFW-99MQ vulnerabilities

Vulnerabilities for packages: telegraf, flux-image-automation-controller, gitness, kine, minio, kubernetes-dashboard, external-dns, nerdctl, skaffold, rancher-agent, fscrypt, cilium, opentelemetry-collector, snyk-cli, kaf, spire-server, aactl, helm, k9s, flux-notification-controller, flux,...

GHSA-GJHQ-GJFW-99MQ vulnerabilities

Vulnerabilities for packages: crossplane-cli-fips, argo-cd-fips, helm, cilium, prometheus-operator, cloudbeat-fips, loki, sftpgo, kubescape, falco-no-driver, minio-fips, frankenphp-8.2, coder-fips, kubernetes-dashboard, tbot, cert-manager, kine, skaffold-fips, coder,...

ROS-20260831-73-0014

The vulnerability of the metaphone function ext/standard/metaphone.c in the PHP programming language is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to trigger segmentation errors and cause service failures...

GHSA-6XFF-CPCQ-VPW2 vulnerabilities

Vulnerabilities for packages: commercial-grafana, grafana, grafana-fips...

CVE-2026-55857 vulnerabilities

Vulnerabilities for packages: zipkin, flyway-fips, flyway, camunda, debezium, keycloak, keycloak-fips, airbyte-platform-fips, airbyte-platform, metabase, reposilite, request-9047-keycloak-fips, camunda-zeebe...

GHSA-G9JJ-CGMH-9F38 vulnerabilities

Vulnerabilities for packages: zipkin, flyway-fips, flyway, camunda, debezium, keycloak, keycloak-fips, airbyte-platform-fips, airbyte-platform, metabase, reposilite, request-9047-keycloak-fips, camunda-zeebe...

GHSA-QXVW-FVWX-5CP7 vulnerabilities

Vulnerabilities for packages: debezium, zipkin, flyway, keycloak...

GHSA-6HX8-3WJJ-GR8G vulnerabilities

Vulnerabilities for packages: openstack-placement-2025.1, openstack-placement-2025.1-fips, openstack-glance-2025.2-fips, openstack-placement-2025.2, openstack-tempest-2025.1, openstack-nova-2025.1, openstack-horizon-2026.1, openstack-glance-2025.2, openstack-nova-2025.2, openstack-nova-2026.1,...