CLEANSTART-2026-KS35076 Security fix for CVE-2026-22039 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r7

CVE-2026-22039 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EE99058 Security fix for CVE-2026-23881 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r7

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VX56698 Security fix for CVE-2024-48921 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JI50806 Security fix for CVE-2025-47281 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VJ98320 Security fix for CVE-2025-46342 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LU55678 Security fix for CVE-2023-47630 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-FU09912 Security fix for CVE-2023-34091 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ON51112 Security fix for CVE-2025-27612 applied in: nvidia-device-plugin 0.19.2-r1

Security vulnerability affects the nvidia-device-plugin package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZM91804 Security fix for CVE-2026-32637 applied in: velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.13.2-r6, velero-plugin-for-aws 1.14.2-r1

CVE-2026-32637 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Malicious Package

Overview lint-xo-ceres-mini-css-extract-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102930 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

EUVD-2026-82494

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...

CVE-2026-93454

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

CVE-2026-87771: Improper Neutralization of Special Elements used in an SQL Command

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-85705: Improper Neutralization of Special Elements used in an SQL Command

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-92554: Improper Neutralization of Input During Web Page Generation

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92714: Authorization Bypass Through User-Controlled Key

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate function hooked on admininit. This is due to the handler only verifying the generic 'editposts' capability and a plugin-wide static nonce NONCEKEY...

PT-2026-101793

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-93870: Cross-Site Request Forgery (CSRF)

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-93869: URL Redirection to Untrusted Site

Cotonti through 1.0.0 contains an open redirect vulnerability in the coturlcheck function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect user...