CLEANSTART-2026-JS43220 Security fix for GHSA-78h2-9frx-2jm8 applied in: consul 1.21.5-r1

Security vulnerability affects the consul package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IF71348 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the consul package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-MD19554 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the consul package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...

CLEANSTART-2026-BX44757 For certain crafted inputs, a 'ed25519

Security vulnerability affects the consul package. For certain crafted inputs, a 'ed25519...

CLEANSTART-2026-NY69031 norm

CVE-2026-56852 affects multiple packages. A norm. See references for individual vulnerability details...

CLEANSTART-2026-NY71627 HashiCorp memberlist before version 0

CVE-2026-14362 affects multiple packages. HashiCorp memberlist before version 0. See references for individual vulnerability details...

CLEANSTART-2026-SE64937 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-SM16447 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-YE69312 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-JQ09832 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-MT59352 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

mako TemplateLookup Function Unauthenticated Access

The vulnerability of the TemplateLookup.gettemplate function in the mako/lookup.py file of the Sqlalchemy mako template library in Python is related to an incorrect path name limitation for accessing restricted directories. Exploiting this vulnerability could allow an attacker to gain unauthorize...

UBUNTU-CVE-2026-61812

GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion...

UBUNTU-CVE-2026-61813

GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS...

UBUNTU-CVE-2026-73856

GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical Content-Type casing...

PT-2026-104289

Name of the Vulnerable Software and Affected Versions Apache Thrift C++ library versions 0.7.0 through 0.24.0 Apache Thrift D library versions 0.9.0 through 0.24.0 Description Improper validation of certificates with host mismatches occurs in the C++ and D libraries. The default access manager fo...

OPENSUSE-SU-2026:11953-1 aliyun-cli-3.5.1-2.1 on GA media

These are all security issues fixed in the aliyun-cli-3.5.1-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11978-1 yast2-users-5.0.9-1.1 on GA media

These are all security issues fixed in the yast2-users-5.0.9-1.1 package on the GA media of openSUSE Tumbleweed...

21millionpixels-mcp (>=0.2.0, <=0.2.1), @0xkillaflow/agama-redmine-mcp (>=1.0.0, <=2.1.0) +4898 more potentially affected by unknown CVE via @modelcontextprotocol/sdk (>=1.24.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.24.0, =0.2.0, =1.0.0, =0.1.3, =0.1.8, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =8.0.0, =0.14.0, =0.1.0, =0.2.0, =0.7.0, =1.0.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0090...

PT-2026-104324

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The protocol skip routine in several Apache Thrift bindings fails to apply the recursion limit. This allows a message containing deeply nested unknown fields to exhaust the stack, potentially...