CVE-2026-62182: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.18 / 10.4.x < 11.3.10 (JSDSERVER-16727)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16727 advisory. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter ...

CVE-2026-82399 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache-fips, juicefs, k8sgateway, kubernetes-dns-node-cache, k8sgateway-fips, eks-distro, eks-distro-fips...

GHSA-MRG3-QVQR-JW29 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache-fips, juicefs, k8sgateway, kubernetes-dns-node-cache, k8sgateway-fips, eks-distro, eks-distro-fips...

CVE-2026-86003 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache-fips, juicefs, k8sgateway, kubernetes-dns-node-cache, k8sgateway-fips, eks-distro, eks-distro-fips...

GHSA-9GM5-9RFH-M6VX vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache-fips, juicefs, k8sgateway, kubernetes-dns-node-cache, k8sgateway-fips, eks-distro, eks-distro-fips...

CVE-2026-92708

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708

Svelte devalue is a JavaScript serialization library for use with SvelteKit, Nuxt, and other frameworks. In versions 5.1.0 through 5.9.2 , the stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view. Since a Node Buffer's backing...

CVE-2026-93839 LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

EUVD-2026-83208

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550 Icinga 2: Improper access control for JSON-RPC update certificate messages

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61550

Icinga 2 (open source monitoring system) is vulnerable to improper access control in its JSON-RPC certificate update message handling (affected: 2.8 through 2.14.9, 2.15.4, and 2.16.2 ). The handler does not validate that the sender is a trusted endpoint, allowing an unauthenticated attacker with...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-77301 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-77301 Source advisory: OSV:GHSA-7Q85-XJ36-VMFC...

ROOT-APP-NPM-GHSA-2P49-HGCM-8545 GHSA-2p49-hgcm-8545 in svgo - Patched by Root

Root has patched GHSA-2p49-hgcm-8545 in the svgo package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-PO69653 Security fix for CVE-2022-46146 applied in: prometheus 2.40.4-r1, prometheus-fips 2.40.4-r1, prometheus-node-exporter 1.5.0-r0, prometheus-node-exporter-fips 1.5.0-r0

CVE-2022-46146 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RD73080 Security fix for GHSA-cgrx-mc8f-2prm applied in: eks-distro-kube-apiserver 1.34.2-r0, eks-distro-kube-apiserver-fips 1.34.2-r0, eks-distro-kube-controller-manager-fips 1.34.2-r0, kaniko 1.24.0-r0, kaniko-fips 1.24.0-r0, local-static-provisioner 2.6.0-r1, local-static-provisioner-fips 2.6.0-r1, local-static-provisioner-fips 2.7.0-r1, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r1, prometheus-node-exporter-fips 1.10.2-r3, prometheus-node-exporter-fips 1.7.0-r2, prometheus-node-exporter-fips 1.8.2-r2, prometheus-node-exporter-fips 1.9.1-r1, runc 1.1.14-r0, skaffold 2.16.1-r1, trivy-fips 0.67.2-r0, velero 1.17.0-r0

GHSA-cgrx-mc8f-2prm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...