Security update for alloy (important)

openSUSE security update: security update for alloy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20752-1 Rating: important References: bsc1258099 bsc1258609 bsc1259919 bsc1260317 Cross-References: CVE-2026-25934 CVE-2026-26958 CVE-2026-33186...

CLEANSTART-2026-JC64695 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-26958, CVE-2026-35469, ghsa-f6x5-jh6r-wrfv, ghsa-fw7p-63qq-7hpr, ghsa-gx3x-vq4p-mhhv, ghsa-j5w8-q4qc-rx2x, ghsa-mh2q-q3fh-2475, ghsa-pc3f-x583-g7j2 applied in versions: 1.16.1-r0, 1.16.1-r1, 1.18.0-r0, 1.19.0-r1

Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AQ65185 Security fixes for CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-61727, CVE-2025-61729, CVE-2026-1229, CVE-2026-24051, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32285, CVE-2026-32289, CVE-2026-33186, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-34986, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-39882, CVE-2026-42499, CVE-2026-42501, CVE-2026-44740, CVE-2026-45022, CVE-2026-4660, ghsa-389r-gv7p-r3rp, ghsa-3xc5-wrhm-f963, ghsa-6g7g-w4f8-9c9x, ghsa-78h2-9frx-2jm8, ghsa-92mm-2pjq-r785, ghsa-9h8m-3fm2-qjrq, ghsa-fw7p-63qq-7hpr, ghsa-q9hv-hpm4-hj6x, ghsa-w8rr-5gcm-pp58, ghsa-xmrv-pmrh-hhx2 applied in versions: 0.93.13-r1, 0.96.1-r0, 0.96.1-r1, 0.96.1-r2, 0.96.1-r3, 0.96.1-r4, 0.96.1-r5, 0.96.1-r6

Multiple security vulnerabilities affect the terragrunt-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VY24921 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 0.18.0-r0, 0.18.0-r1

Multiple security vulnerabilities affect the prometheus-mysqld-exporter package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HX97842 Security fixes for CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-54410, CVE-2025-58181, CVE-2025-58190, CVE-2025-61727, CVE-2025-61729, CVE-2025-68121, CVE-2026-1229, CVE-2026-24051, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186 applied in versions: 2.2.2-r6, 2.3.2-r4, 2.4.4-r2, 2.5.0-r0, 2.5.0-r1

Multiple security vulnerabilities affect the openbao-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JK59495 Security fixes for CVE-2025-0913, CVE-2025-4673, CVE-2025-47907, CVE-2026-24051, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-2464-8j7c-4cjm, ghsa-9h8m-3fm2-qjrq, ghsa-fw7p-63qq-7hpr, ghsa-p77j-4mvh-x3m3 applied in versions: 3.3.2-r0, 3.4.2-r0, 3.4.2-r3, 3.4.2-r4

Multiple security vulnerabilities affect the kyverno-policy-reporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AM88528 Security fixes for CVE-2025-15558, CVE-2025-61729, CVE-2026-24051, CVE-2026-25679, CVE-2026-25934, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-2464-8j7c-4cjm, ghsa-2x5j-vhc8-9cwm, ghsa-37cx-329c-33x3, ghsa-fv92-fjc5-jj9h, ghsa-fw7p-63qq-7hpr, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3 applied in versions: 3.6.16-r0, 3.6.18-r0, 3.6.19-r0, 3.6.19-r1, 3.6.19-r2, 3.6.19-r3, 3.7.4-r0

Multiple security vulnerabilities affect the argo-workflows package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SN90101 Security fixes for CVE-2025-15558, CVE-2025-61729, CVE-2026-25934, CVE-2026-26958, CVE-2026-33186, ghsa-2464-8j7c-4cjm, ghsa-2x5j-vhc8-9cwm, ghsa-37cx-329c-33x3, ghsa-fv92-fjc5-jj9h, ghsa-fw7p-63qq-7hpr, ghsa-p436-gjf2-799p applied in versions: 3.6.16-r0, 3.7.4-r0, 3.7.9-r0, 4.0.1-r0, 4.0.2-r0, 4.0.3-r0

Multiple security vulnerabilities affect the argo-workflows package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OW78143 Security fixes for CVE-2025-68156, CVE-2026-24051, CVE-2026-26958, CVE-2026-33186, ghsa-9h8m-3fm2-qjrq, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr, ghsa-p77j-4mvh-x3m3 applied in versions: 2.18.3-r0, 2.18.3-r1

Multiple security vulnerabilities affect the keda package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-26958

creationtimestamp| type| source ---|---|--- 2026-03-18 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0315/...

Security update for cosign

This update for cosign fixes the following issues: Update to version 3.0.5 jscSLE-23879. Security issues fixed: CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs bsc1250620. CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause...

cosign-3.0.5-1.1 on GA media (moderate)

cosign-3.0.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:10235-1 Rating: moderate Cross-References: CVE-2026-22772 CVE-2026-23991 CVE-2026-23992 CVE-2026-24122 CVE-2026-24137 CVE-2026-26958 CVSS scores: CVE-2026-22772 SUSE : 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVE-2026-22772 SU...

Linux Distros Unpatched Vulnerability : CVE-2026-26958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and...

AZL-78216 CVE-2026-26958 affecting package telegraf 1.31.0-15

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If Point.MultiScalarMult i...

CVE-2026-26958

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If Point.MultiScalarMult i...

CVE-2026-26958 filippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If Point.MultiScalarMult i...

CVE-2026-26958 vulnerabilities

Vulnerabilities for packages: aactl, kine, spire-server, dex, dbmate, terragrunt, trufflehog, step-kms-plugin, flux-kustomize-controller, dgraph, temporal, trillian, ksops, seaweedfs, gitea, sftpgo-plugin-eventstore, sops, tailscale, croc, cerbos, rekor, sqlexporter, grafana-alloy, minio,...

CVE-2026-26958 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller-fips, fulcio-fips, cerbos, spire-server-fips, certificate-transparency-fips, agentbeat, terragrunt-fips, hydra, amass, terragrunt, ratify, sftpgo, rke2-runtime, step-ca, kots, telegraf, ory-kratos-fips, dex, jitsucom-bulker, kyverno-fips,...

Siemens SIMATIC Devices Use After Free (CVE-2024-26958)

In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2025-109 (ALASKERNEL-5.4-2025-109)

The version of kernel installed on the remote host is prior to 5.4.298-218.429. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-109 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: idle: Check...