CVE-2026-28185

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

EUVD-2026-57963

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

CVE-2026-18667

Affected product: Tenable Sensor Proxy; version: 1.4.2 (the release fixes a vulnerability). Vulnerability and impact: A remote attacker can cause code to execute with elevated privileges by persuading an operator to connect the sensor to an attacker-controlled host. The CVSS metrics indicate high...

CVE-2025-71401 better-auth before 1.4.2 basePath Modification DoS

better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...

SUSE SLES12 Security Update : prometheus-ha_cluster_exporter (SUSE-SU-2026:3421-1)

The remote SUSE Linux SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3421-1 advisory. This update for prometheus-haclusterexporter fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2 Use proper obs time forma...

CLEANSTART-2026-RU30186 Security fixes in kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r6

Package kyverno-policy-reporter-kyverno-plugin-fips version 1.4.2-r6 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-25679, CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-RY09164 Security fixes in runc 1.4.2-r0

Package runc version 1.4.2-r0 fixes 14 vulnerabilities: CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506, CVE-2026-25680...

CLEANSTART-2026-HI11679 Security fixes in kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r8

Package kyverno-policy-reporter-kyverno-plugin-fips version 1.4.2-r8 fixes 7 vulnerabilities: CVE-2026-32280, CVE-2026-32282, CVE-2026-32281, CVE-2026-32288, CVE-2026-32289...

CLEANSTART-2026-PE23465 Security fixes in runc 1.4.2-r1

Package runc version 1.4.2-r1 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-JU25374 Security fixes in kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r9

Package kyverno-policy-reporter-kyverno-plugin-fips version 1.4.2-r9 fixes 11 vulnerabilities: CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820...

CLEANSTART-2026-JJ27428 Security fixes in kafka-ui 1.4.2-r6

Package kafka-ui version 1.4.2-r6 fixes 46 vulnerabilities: CVE-2026-40973, CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2: Use proper obs time form...

CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952

Valibot has a concrete vulnerability CVE-2026-59952 in versions prior to 1.4.2 where record() can produce issue paths containing attacker-controlled Object.prototype-like keys (e.g., toString, valueOf, hasOwnProperty). When flatten() processes these issues, flatErrors.nested[dotPath] resolves to ...

CVE-2026-59552

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

CVE-2026-59552

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

EUVD-2026-49221

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

Improper Handling of Exceptional Conditions

Overview valibot is a The modular and type safe schema library for validating structural data Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions in the flatten process. An attacker can cause the application to throw a TypeError and disrupt normal error...

WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...