GO-2026-4918 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, crossplane-provider-azure-portal, crossplane-provider-terraform-fips, k8s-metacollector-fips, rke2-runtime, docker-credential-ecr-login-fips, wave-fips, trivy-k8s-wrapper, prometheus-alertmanager, litestream, syncthing-fips, cilium-fips,...

CVE-2025-53940 Quiet uses insecure, inconsistent verification on local backend token

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for tok...