CLEANSTART-2026-ZR04706 Security fix for CVE-2025-44005 applied in: step-cli 0.27.5-r1, step-issuer-fips 0.9.11-r1

CVE-2025-44005 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JI14170 Security fix for GHSA-q4r8-xm5f-56gw applied in: step-cli 0.27.5-r0, step-issuer 0.10.0-r0, step-issuer 0.10.1-r0

GHSA-q4r8-xm5f-56gw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TM64574 Security fix for CVE-2026-30836 applied in: step 0.28.7-r3, step 0.29.0-r2, step-cli 0.27.5-r1, step-issuer 0.10.0-r0, step-issuer 0.10.1-r0, step-issuer 0.10.2-r0, step-issuer 0.9.11-r1

CVE-2026-30836 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OJ21892 Security fix for CVE-2026-25518 applied in: cert-manager-cmctl-fips 2.4.0-r2, percona-xtradb-cluster-operator 1.18.0-r1, percona-xtradb-cluster-operator-fips 1.18.0-r1, step-issuer 0.9.11-r1

CVE-2026-25518 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-99990

Security vulnerability affects the step-issuer-fips package. This issue is resolved in later releases. See references for vulnerability details...

EulerOS 2.0 SP15 : glib-networking (EulerOS-SA-2026-3779)

According to the versions of the glib-networking package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain ...

EulerOS 2.0 SP15 : glib-networking (EulerOS-SA-2026-3804)

According to the versions of the glib-networking package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain ...

CVE-2026-86466 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-86466

The apache-airflow-providers-fab package is vulnerable to an Origin Validation Error because the Authentik OAuth path in the FAB auth manager fails to validate the issuer or audience claims of accepted id_tokens. An attacker who possesses a valid token issued by the same Authentik identity provid...

CVE-2026-88819

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

CVE-2026-88819

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

Astra Linux – Vulnerability in openssl1.0

The OpenSSL public API function X509issuerandserialhash attempts to generate a unique hash value based on the issuer and serial number data contained within an X509 certificate. However, it fails to properly handle any errors that may occur during the parsing of the issuer field—errors that could...

PT-2026-91253

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...

EUVD-2026-42963

ZITADEL: Missing Token Expiration exp Validation in JWT IdP Provider...

EUVD-2026-72933

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

CVE-2026-75156

The apache-airflow-providers-fab package (versions 3.7.3 through 3.8.0) is vulnerable to an Origin Validation Error during OAuth login when configured with Azure AD. The root cause is the failure to validate the issuer or audience of Azure AD id_tokens within the _decode_and_validate_azure_jwt fu...

CVE-2026-75156 Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

CLEANSTART-2026-EG40747 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the step-issuer package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

CLEANSTART-2026-QK25151 Previously, a channel registered in the mux's chanList is not usable until it is established

Multiple security vulnerabilities affect the step-issuer package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...

EulerOS 2.0 SP12 : glib-networking (EulerOS-SA-2026-3260)

According to the versions of the glib-networking package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain ...