Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

GO-2024-2653 vulnerabilities

Vulnerabilities for packages: hubble-ui-backend-fips, hubble-ui...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: amazon-ssm-agent, scorecard, syft, cerbos-fips, argo-cd-fips, chainloop-cli, rclone, terragrunt-fips, external-secrets-operator-fips, gitlab-rails-ce, packer-fips, grafana, argo-cd, flux, rclone-fips, kyverno-fips, seaweedfs-rocksdb, rancher-fleet, rancher-fleet-fips...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: syft, guac, gitea, amazon-ssm-agent-fips, kyverno, packer, argo-events-fips, xeol, kubevela, kyverno-fips, kaniko-fips, livekit-cli, grafana-alloy-fips, grafana-fips, src-fingerprint-fips, external-secrets-operator, gitaly, flux-source-controller-fips, src-fingerprin...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: certificate-transparency, mc, grafana-pyroscope-fips, tempo-fips, karma-fips, prometheus-fips, tempo, datadog-agent-fips, cloud-sql-proxy-fips, splunk-otel-collector-fips, keda, loki, beats-fips, node-problem-detector-fips, beats, prometheus-pushgateway-fips,...

GO-2024-2599 vulnerabilities

Vulnerabilities for packages: metallb, kubernetes-dashboard-metrics-scraper, wire-go, smarter-device-manager-fips, temporal-fips, kyverno-policy-reporter-kyverno-plugin, go-licenses, fq, volume-modifier-for-k8s, regclient, logstash-exporter-fips, smarter-device-manager, thanos, hello-world-golang...

GO-2026-4945 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, neuvector-sigstore-interface, syft, consul, temporal-fips, prometheus-podman-exporter, step-kms-plugin-fips, vexctl, conftest-fips, grafana-alloy-fips, gitlab-cng-fips, seaweedfs-operator-fips, cloudflared-fips, gatus-fips,...

GO-2026-5029 vulnerabilities

Vulnerabilities for packages: flux, glab, gitea, ingress-nginx-controller, hydra, kyverno, snyk-cli, prometheus, crossplane-provider-azure-authorization, zot, gptscript, istio, k3s, minio, karpenter, cilium, mattermost, crossplane-provider-aws-elasticache, kubernetes, grafana-pyroscope, hubble,...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: flux, tfsec, osv-scanner, wolfictl, gitsign, gitaly, gitea, zarf, gomplate, argo-cd, pulumi-language-yaml, kyverno, snyk-cli, argocd-image-updater, melange, witness, cerbos, nfpm, pulumi, pulumi-language-dotnet, crossplane, apko, kubescape, src-fingerprint, zot,...

GO-2024-3305 vulnerabilities

Vulnerabilities for packages: kubevela, rancher-agent, k3s, amazon-cloudwatch-agent-operator, pulumi, promxy...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

OPENSUSE-SU-2026:11509-1 python3-ansible-compat-26.8.0-1.1 on GA media

These are all security issues fixed in the python3-ansible-compat-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-17346

A flaw was found in pgAdmin 4. A low-privileged user can exploit a SQL injection vulnerability when object names, such as schema, table, publication, or subscription names, containing special characters are not properly escaped. When any user, including those with higher privileges, views the...

CVE-2026-68281

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...

CVE-2026-68281 drm/imagination: Count paired job fence as dependency in prepare_job()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...

SUSE SLES15 Security Update : azure-storage-azcopy (SUSE-SU-2026:3528-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3528-1 advisory. Update to 10.32.6. Security issues fixed: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded...

SUSE-SU-2026:3528-1 Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues: Update to 10.32.6. Security issues fixed: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266657. - CVE-2026-56852:...

OPENSUSE-SU-2026:21540-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...

SUSE-SU-2026:3480-1 Security update for kubevirt

This update for kubevirt fixes the following issues: - Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: CVE-2026-39821 bsc1266575: the previous entry claimed this fixed by the golang.org/x/net v0.55.0...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses spring-security-core-6.5.10.jar, form-data-4.0.5.tgz, ws-8.20.1.tgz, pythonmultipart-0.0.27-py3-none-any.whl, starlette-1.2.1-py3-none-any.whl, httpcore5-5.3.6.jar, httpcore5-h2-5.3.6.jar, mlflow-3.13.0-py3-none-any.whl, js-yaml-4.2.0.tgz and tar-7.5.16.tgz which ar...