CLEANSTART-2026-UE62573 Security fix for CVE-2023-52425 applied in: expat 2.6.0-r0

Security vulnerability affects the expat package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CR95275 Security fix for CVE-2026-46718 applied in: apache-nifi 2.6.0-r3

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-AO69724 Security fix for CVE-2026-41719 applied in: apache-nifi 2.6.0-r3

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-KL73981 Security fix for CVE-2026-25903 applied in: apache-nifi 2.6.0-r3

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DA25552 Security fix for CVE-2026-23868 applied in: apache-nifi 2.6.0-r3

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EF04271 Security fix for CVE-2023-5528 applied in: local-static-provisioner 2.6.0-r1

Security vulnerability affects the local-static-provisioner package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-91982 Vikunja before 2.6.0 TOTP Secret Disclosure via API

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticato...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.0.0 to 3.0.6, and 2.6.0 to 2.6.12, the CMS dissector could crash. This issue was addressed in the epan/dissectors/asn1/cms/packet-cms-template.c file by ensuring that an object identifier is set to NULL after the ContentInfo dissection...

EUVD-2026-76118

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

GHSA-MVXR-6M87-MV2Q vulnerabilities

Vulnerabilities for packages: kube-logging-operator, pghero, ruby3.3-mail, pghero-fips, logstash...

CVE-2026-55088 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...

CVE-2026-52876 Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or...

CVE-2026-31221

A flaw was found in PyTorch-Lightning. This vulnerability, categorized as insecure deserialization CWE-502, exists in the checkpoint loading mechanism. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, which, when loaded by the LightningModule.loadfromcheckpoi...

SUSE SLED15 / SLES15 Security Update : runc (SUSE-SU-2026:3433-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3433-1 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem...

CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: Version 1.3.6: When masking directories with maskPaths, runc will now re- use a...

CLEANSTART-2026-LS31755 Security fixes in expat 2.6.0-r0

Package expat version 2.6.0-r0 fixes 2 vulnerabilities: CVE-2023-52425, CVE-2023-52426...

CLEANSTART-2026-TY63530 Security fixes in mongosh 2.6.0-r2

Package mongosh version 2.6.0-r2 fixes 3 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74...

CLEANSTART-2026-FL96433 Security fixes in mongosh 2.6.0-r4

Package mongosh version 2.6.0-r4 fixes 15 vulnerabilities: ghsa-rp42-5vxx-qpwr, ghsa-gh4j-gqv2-49f6, CVE-2026-41650, CVE-2026-33036, CVE-2026-33349...

CVE-2026-50622

A missing authorization vulnerability exists in Apache Atlas affecting versions 0.8 through 2.5.0 . The flaw allows any authenticated user to bypass role-based access controls and perform administrative operations on the system's admin endpoints . To remediate this issue, users are recommended to...