CLEANSTART-2026-JU25374 Security fixes in kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r9

Package kyverno-policy-reporter-kyverno-plugin-fips version 1.4.2-r9 fixes 11 vulnerabilities: CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820...

CLEANSTART-2026-JJ27428 Security fixes in kafka-ui 1.4.2-r6

Package kafka-ui version 1.4.2-r6 fixes 46 vulnerabilities: CVE-2026-40973, CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2: Use proper obs time form...

CVE-2026-59952

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952

Valibot has a concrete vulnerability CVE-2026-59952 in versions prior to 1.4.2 where record() can produce issue paths containing attacker-controlled Object.prototype-like keys (e.g., toString, valueOf, hasOwnProperty). When flatten() processes these issues, flatErrors.nested[dotPath] resolves to ...

CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59552

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

EUVD-2026-49221

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

CVE-2026-59552

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

Improper Handling of Exceptional Conditions

Overview valibot is a The modular and type safe schema library for validating structural data Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions in the flatten process. An attacker can cause the application to throw a TypeError and disrupt normal error...

WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...

CVE-2026-65483

CVE-2026-65483 describes a Cross Site Scripting (XSS) vulnerability in the WordPress plugin HashThemes Demo Importer, version

PT-2026-64065

These are all security issues fixed in the prometheus-ha cluster exporter-1.4.2-1.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2026-44900

The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'deleteuserroles' parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15727

The CVE-2026-15727 entry concerns the WP Bulk Delete WordPress plugin. Affected: WP Bulk Delete (plugins bundle) up to version 1.4.2. Vulnerability: generic SQL Injection via the delete_user_roles parameter, caused by insufficient escaping of user-supplied input and inadequate preparation in the ...

CVE-2026-15727 WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter

The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'deleteuserroles' parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

CVE-2026-23744-MCPJam-Exploit A proof-of-concept exploit for C...

CVE-2025-56362

The CVE-2025-56362 entry concerns the Matter SDK (connectedhomeip) before 1.4.2. Affected component: Level Control cluster’s periodic server tick logic. Attack scenario: issuing a MoveToLevel command and immediately writing OperationMode=2 in the Pump Configuration and Control cluster can trigger...

CVE-2026-58588

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting XSS. This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1...