CVE-2026-93564 Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

CVE-2026-93564 Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

CVE-2026-88017

A flaw was found in rclone, a command-line program for syncing files to cloud storage providers. The FTP authentication proxy driver improperly handles user credentials across sessions. If two users share the same username but are linked to different storage backends, a later login can overwrite...

CLEANSTART-2025-LI04591 Security fix for ghsa-8pgv-569h-w5rw applied in: kube-rbac-proxy-fips 0.16.1-r0, kube-rbac-proxy-fips 0.17.1-r0

ghsa-8pgv-569h-w5rw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JO61169 Security fix for CVE-2025-25193 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r1, cassandra-reaper-fips 3.6.1-r3, cassandra-reaper-fips 3.7.1-r4, cassandra-reaper-fips 3.8.0-r9, stargate 1.0.90-r4, stargate 2.0.44-r4, wavefront-proxy 13.9-r0

CVE-2025-25193 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UT87465 Security fix for CVE-2024-47535 applied in: cassandra-reaper-fips 3.6.1-r3, cassandra-reaper-fips 3.7.1-r4, cassandra-reaper-fips 3.8.0-r9, stargate 1.0.90-r4, stargate 2.0.44-r4, wavefront-proxy 13.9-r0

CVE-2024-47535 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WX98104 Security fix for CVE-2026-42338 applied in: opensearch-dashboards-fips 2.19.5-r0, proxy-agent 6.5.0-r0, pulumi 3.248.0-r0, renovate 43.123.8-r3, renovate 44.31.0-r2, renovate 44.32.4-r1, renovate 44.32.5-r1, renovate 44.32.6-r1, sqlpad 7.5.7-r3

CVE-2026-42338 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PE96268 Security fix for ghsa-rp42-5vxx-qpwr applied in: kibana 9.3.2-r3, mongosh 2.5.10-r5, mongosh 2.6.0-r4, mongosh 2.8.2-r3, proxy-agent 6.5.0-r0, proxy-agent 7.0.0-r2, proxy-agent 8.0.2-r0

ghsa-rp42-5vxx-qpwr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YI17709 Security fix for CVE-2025-33042 applied in: apache-hive 4.0.1-r11, apache-hive 4.1.0-r7, apache-hive 4.2.0-r11, wavefront-proxy 13.9-r0

CVE-2025-33042 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NF21884 Security fix for ghsa-rpmf-866q-6p89 applied in: kibana 9.3.2-r3, proxy-agent 6.5.0-r0, proxy-agent 7.0.0-r2, proxy-agent 8.0.2-r0

ghsa-rpmf-866q-6p89 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MV16544 Security fix for CVE-2026-46597 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300066.1-r1, apko 1.2.13-r0, apko 1.2.2-r2, argo-cd 3.3.5-r1, argo-cd-fips 3.1.14-r2, argo-workflows 4.0.5-r0, authservice 1.1.5-r1, authservice 1.1.6-r1, cadvisor 0.55.1-r1, cadvisor 0.57.0-r0, cadvisor-fips 0.55.1-r0, calico 3.30.7-r2, cert-manager 1.17.4-r2, cert-manager 1.18.6-r1, cert-manager 1.20.0-r0, cert-manager 1.20.2-r0, cert-manager-webhook-pdns-fips 2.5.5-r1, cfssl 1.5.0-r1, cluster-autoscaler 1.35.2-r2, consul 2.0.1-r0, cortex 1.21.0-r2, cosign 3.0.6-r1, crossplane-provider-sql-fips 0.15.0-r3, dynatrace-operator 1.6.3-r1, elastic-beats 8.19.15-r5, elastic-beats 9.2.8-r2, elastic-beats-fips 9.2.8-r0, external-secrets-fips 0.17.0-r2, external-secrets-operator 2.5.0-r1, flux-image-automation-controller 1.2.1-r1, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r1, fulcio-fips 1.7.1-r3, gostatsd 28.3.0-r2, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, haproxy-ingress 0.14.12-r1, helm 4.0.5-r2, helm-operator 1.42.2-r0, istio 1.28.5-r3, istio 1.29.2-r1, istio-fips 1.26.8-r4, istio-fips 1.27.9-r2, istio-fips 1.30.0-r1, kube-rbac-proxy 0.20.2-r2, kube-rbac-proxy 0.21.2-r0, kube-rbac-proxy-fips 0.20.2-r2, kube-state-metrics 2.10.1-r2, kube-state-metrics-fips 2.18.0-r1, kube-vip 1.1.0-r1, kubernetes 1.36.1-r0, kubernetes-csi-external-provisioner-fips 6.1.0-r4, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-csi-external-resizer-fips 2.1.0-r1, kubernetes-csi-external-snapshotter-fips 8.4.0-r4, kubernetes-event-exporter 1.7-r1, kubernetes-event-exporter-fips 1.7-r0, local-static-provisioner 2.8.0-r2, melange 0.50.0-r1, melange 0.56.1-r1, memcached-exporter 0.16.0-r0, minio-client 0.20250721.052808-r1, mongodb 7.0.32-r1, mongodb 8.0.20-r1, mongodb 8.0.21-r1, mongodb 8.2.6-r1, mongodb 8.3.2-r1, ollama 0.20.3-r2, ollama 0.31.2-r2, ollama 0.32.11-r2, ollama-fips 0.32.11-r2, opa 1.17.0-r1, percona-server-mongodb-operator 1.22.0-r1, percona-server-mongodb-operator 1.23.0-r0, policy-controller-fips 0.15.1-r1, postgres-operator 1.12.2-r2, postgres-operator 1.15.1-r1, prometheus 3.11.2-r0, prometheus 3.5.2-r1, prometheus-alertmanager 0.32.0-r1, prometheus-blackbox-exporter 0.28.0-r2, prometheus-mysqld-exporter 0.15.0-r2, prometheus-node-exporter-fips 1.11.1-r1, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.11.3-r1, prometheus-pushgateway 1.8.0-r1, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r1, prometheus-pushgateway-fips 1.8.0-r2, prometheus-redis-exporter-fips 1.84.0-r0, prometheus-redis-exporter-fips 1.87.0-r3, promxy-fips 0.0.93-r1, pulumi-kubernetes-operator 2.7.0-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, rancher-fleet-agent 0.12.17-r3, rancher-fleet-agent 0.13.13-r1, rancher-fleet-agent 0.14.10-r1, rancher-fleet-agent 0.14.8-r3, rancher-fleet-agent 0.15.4-r3, rancher-fleet-agent 0.15.6-r0, rancher-fleet-agent 0.16.1-r1, rclone 1.69.0-r3, restic-fips 0.18.1-r7, rundeck 6.0.0-r0, sealed-secrets 0.34.0-r0, sealed-secrets 0.35.0-r4, sealed-secrets 0.36.6-r1, secrets-store-csi-driver-provider-gcp 1.15.0-r1, secrets-store-csi-driver-provider-gcp 1.17.0-r2, spire-server 1.13.5-r1, spire-server 1.14.5-r1, spire-server-fips 1.14.5-r1, step-ca-fips 0.30.2-r1, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, syft 1.45.0-r2, tempo 2.10.4-r1, temporal 1.5.1-r0, temporal-server 1.31.0.153.1-r0, temporal-ui-server-fips 2.51.1-r1, terraform 1.14.8-r2, tigera-operator 1.42.0-r0, tigera-operator-fips 1.37.2-r4, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.45.0-r1, tkn-fips 0.44.2-r0, trust-manager-fips 0.20.3-r2, trust-manager-fips 0.21.1-r2, vault 1.20.4-r5, vault 1.21.4-r5, vault 2.0.0-r1, vault-k8s 1.7.4-r0, velero 1.18.1-r0, velero-fips 1.18.2-r6, weaviate 1.37.4-r1, weaviate 1.37.6-r1, weaviate-fips 1.36.17-r0, weaviate-fips 1.37.9-r0, weaviate-fips 1.38.1-r0

CVE-2026-46597 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LZ49764 Security fix for CVE-2026-41324 applied in: proxy-agent 6.5.0-r0, proxy-agent 7.0.0-r2, proxy-agent 8.0.2-r0

CVE-2026-41324 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DY27694 Security fix for CVE-2026-44240 applied in: proxy-agent 6.5.0-r0, proxy-agent 7.0.0-r2, proxy-agent 8.0.2-r0

CVE-2026-44240 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HB04521 Security fix for CVE-2026-54272 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 3.225.0-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.3.0-r1, langfuse-worker 4.3.1-r1, n8n 2.28.0-r2, npm 11.17.0-r2, npm 11.18.0-r2, proxy-agent 6.4.0-r0, proxy-agent 6.5.0-r1, proxy-agent 7.0.0-r2, proxy-agent 8.0.2-r1, renovate 44.31.0-r2, renovate 44.32.4-r1, renovate 44.32.5-r1, renovate 44.32.6-r1

CVE-2026-54272 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

authelia v4.39.28

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

CVE-2026-93676: Improper Access Control

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

PT-2026-105031

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...

How to Configure HTTP Proxy for Veeam Service Provider Console 9.3+

Purpose This article explains how to configure an HTTP proxy for Veeam Service Provider Console 9.3 and later, which introduced a dedicated proxy configuration mechanism that is disabled by default and does not use the WinHTTP, Internet Options, or environment variable proxy settings described in...

EulerOS Virtualization 2.12.0 : nghttp2 (EulerOS-SA-2026-3655)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body ont...