GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster-fips, crossplane-provider-aws-secretsmanager, yunikorn-k8shim-fips, crossplane-provider-aws-osis-fips, hydra-fips, crossplane-provider-aws-route53resolver, zitadel, longhorn-cli, emqx-exporter-fips, cloud-provider-azure-fips,...

GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster-fips, crossplane-provider-aws-secretsmanager, yunikorn-k8shim-fips, crossplane-provider-aws-osis-fips, hydra-fips, crossplane-provider-aws-route53resolver, zitadel, longhorn-cli, docker, emqx-exporter-fips, cloud-provider-azure-fips,...

CVE-2026-39836 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster-fips, crossplane-provider-aws-secretsmanager, yunikorn-k8shim-fips, crossplane-provider-aws-osis-fips, hydra-fips, crossplane-provider-aws-route53resolver, zitadel, longhorn-cli, emqx-exporter-fips, cloud-provider-azure-fips,...

CVE-2026-33811 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-secretsmanager, yunikorn-k8shim-fips, crossplane-provider-aws-osis-fips, hydra-fips, crossplane-provider-aws-route53resolver, zitadel, emqx-exporter-fips, cloud-provider-azure-fips, cloud-provider-azure, nvidia-nsight-compute-13.0, scorecard,...

GHSA-QC64-M6C2-V4X7 vulnerabilities

Vulnerabilities for packages: victoriametrics-cluster-fips, crossplane-provider-aws-secretsmanager, yunikorn-k8shim-fips, crossplane-provider-aws-osis-fips, hydra-fips, crossplane-provider-aws-route53resolver, zitadel, longhorn-cli, docker, emqx-exporter-fips, cloud-provider-azure-fips,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim-fips, crossplane-provider-aws-osis-fips, cloud-provider-azure, gitlab-operator-fips, gostatsd, slsa-verifier, gitness, crossplane-provider-aws-appflow, k8ssandra-operator, cloud-sql-proxy-fips, knative-eventing-fips, crossplane-provider-keycloak, q,...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017342 advisory. A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: NetworkManager (UTSA-2026-016802)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016802 advisory. A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configu...

CVE-2026-42453

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operation...

EUVD-2026-28872

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In versions 2.14.0 and prior, the archive upload endpoint POST /api/v1/archives/linkId?format=4 accepts HTML files text/html without sanitizing JavaScript content. When the archive i...

CLSA-2026-1778266904 kernel: Fix of 188 CVEs

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - xfrm: esp: avoid in-place decrypt on shared skb frags - clk: Fix clkhwgetclk when dev is NULL CVE-2022-49187 - x86/sgx: Add overflow check in sgxvalidateoffsetlength CVE-2022-49785 - ext4: init quota for 'old.inode' in...

CVE-2026-42453 Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operation...

CVE-2026-42453

Termix is affected by a command injection in the file-manager.ts endpoints extractArchive and compressFiles due to the use of double-quoted strings for shell construction, enabling $(command) substitution on the remote SSH host. This vulnerability (CVE-2026-42453) can lead to arbitrary command ex...

MAL-2026-3421 Malicious code in oneblk-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f46bbc3e155a30851463f65a3f9d5af33ebd5172df5ad70f7b022a77448fc6eb The package oneblk-design-system was found to contain malicious code. Source: ossf-package-analysis...

CLSA-2026-1778252773 squid: Fix of CVE-2022-41317

CVE-2022-41317: fix exposure of sensitive cache manager information via non-HTTP URI schemes due to typo in default manager ACL regex...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when handling excessively large HTTP request bodies. A malicious pod on the same cluster can exhaust system memory and trigger an OOM condition. Remediation Upgrade...

NPM: Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

NPM: Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability discovered by ? in WordPress Npm cline versions = 2.13.0...

MAL-2026-3400 Malicious code in typo-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64edea611ad8e383c09495a7a6f7afd4fb86b88136c331ddf787bf0285259bf3 The package typo-crypto was found to contain malicious code...

CVE-2025-71301

A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem, specifically within the shared memory shmem test module. This vulnerability occurs because the reservation lock is not properly held during vmap and vunmap operations. A local attacker could potentially exploit this fl...

NPM: fast-uri vulnerable to path traversal via percent-encoded dot segments

NPM: fast-uri vulnerable to path traversal via percent-encoded dot segments vulnerability discovered by ? in WordPress Npm fast-uri versions = 3.1.0...