EUVD-2026-102111

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

CVE-2026-75505

The open-source customer relationship management application EspoCRM contains an access control bypass in its mass-update functionality. Prior to version 10.0.2 , an authenticated user possessing mass-update permissions can provide a known attachment identifier to the processor. The system duplic...

EUVD-2026-88444

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

PT-2026-102327

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.7 Description An authorization bypass exists in the Invoice Mass Status Update component. A remote attacker can manipulate the endpoint '/admin/sales/invoices/mass-update/state' to perform actions without...

CVE-2026-101139: Missing Authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CLEANSTART-2026-PE41402 Security fix for CVE-2026-39821 applied in: access-log-exporter 0.3.20-r0, amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300066.1-r1, apache-nifi 2.10.0-r4, apko 1.2.13-r0, argo-cd 3.2.12-r5, argo-cd 3.2.7-r3, argo-cd 3.3.5-r2, argo-cd-fips 3.4.7-r3, argo-rollouts-fips 1.9.1-r3, argo-workflows 3.7.17-r3, argo-workflows 4.0.5-r0, atlantis-fips 0.47.1-r1, authservice 1.1.5-r1, authservice 1.1.6-r1, aws-load-balancer-controller 3.2.0-r0, aws-network-policy-agent 1.1.6-r3, aws-network-policy-agent 1.3.2-r1, aws-network-policy-agent-fips 1.3.2-r0, boring-registry 0.18.0-r0, boring-registry-fips 0.17.0-r2, boring-registry-fips 0.18.0-r0, cadvisor 0.55.1-r5, cadvisor 0.56.2-r3, cadvisor 0.57.0-r0, cadvisor 0.57.0-r5, cadvisor 0.60.5-r1, cadvisor-fips 0.55.1-r0, calico 3.30.7-r7, calico 3.31.6-r2, calico 3.32.1-r3, cert-manager 1.17.4-r2, cert-manager 1.18.6-r5, cert-manager 1.19.6-r3, cert-manager 1.20.0-r0, cert-manager 1.20.2-r0, cert-manager 1.20.3-r4, cert-manager 1.21.1-r0, cert-manager-webhook-pdns-fips 2.5.5-r1, cfssl 1.5.0-r1, cloudnative-pg 1.27.4-r2, cloudnative-pg 1.28.4-r1, cloudnative-pg 1.29.1-r0, cloudnative-pg 1.29.1-r2, cloudnative-pg 1.29.2-r2, cloudnative-pg 1.30.0-r1, cloudprober 0.14.3-r1, cluster-autoscaler 1.35.2-r2, configmap-reload 0.15.0-r3, consul 2.0.1-r0, cortex 1.19.1-r3, cortex 1.21.0-r2, cosign 2.6.5-r2, cosign 3.0.6-r2, cosign 3.1.3-r0, dex 2.43.1-r3, dex 2.44.0-r3, dex 2.45.1-r3, dynatrace-operator 1.10.1-r1, dynatrace-operator 1.10.2-r0, dynatrace-operator 1.6.3-r1, dynatrace-operator 1.7.3-r2, dynatrace-operator 1.8.1-r7, dynatrace-operator 1.9.0-r4, eks-distro-kube-scheduler 1.35.2-r0, elastic-beats 9.2.8-r2, elastic-beats 9.2.8-r8, elastic-beats 9.3.8-r1, elastic-beats 9.4.0-r2, elastic-beats-fips 9.2.8-r0, external-secrets-fips 0.17.0-r2, external-secrets-operator 2.5.0-r1, external-secrets-operator 2.6.0-r1, external-secrets-operator 2.6.0-r5, external-secrets-operator 2.7.0-r3, external-secrets-operator 2.8.0-r2, fluent-operator 3.9.0-r2, fluent-operator-fips 3.10.0-r3, flux-kustomize-controller-fips 1.8.5-r0, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r1, fulcio-fips 1.5.1-r3, fulcio-fips 1.6.6-r3, fulcio-fips 1.7.1-r3, git-lfs-fips 3.7.1-r1, gitea 1.26.4-r1, gitlab-kas 18.5.1-r0, go-discover 0_git20250325-r4, gomplate 4.3.3-r3, gostatsd 28.3.0-r2, gosu 1.19-r5, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, grafana-alloy 1.16.1-r0, grafana-org-operator 1.13.0-r2, haproxy-ingress 0.13.19-r2, haproxy-ingress 0.14.12-r3, haproxy-ingress 0.15.4-r5, haproxy-ingress 0.16.1-r5, harbor-trivy-adapter 0.36.0-r0, helm 3.21.4-r1, helm 4.0.5-r6, helm 4.1.4-r3, helm 4.2.3-r1, helm-fips 3.21.4-r0, helm-fips 4.2.4-r0, helm-operator 1.39.2-r2, helm-operator 1.40.0-r2, helm-operator 1.42.2-r4, helm-operator 1.42.3-r3, ingress-nginx-controller 1.12.8-r1, ingress-nginx-controller 1.13.9-r1, ingress-nginx-controller 1.14.5-r4, ingress-nginx-controller 1.15.1-r3, istio 1.27.9-r1, istio 1.28.5-r3, istio 1.29.2-r1, istio 1.29.6-r2, istio 1.30.3-r2, istio-fips 1.26.8-r4, istio-fips 1.27.9-r2, istio-fips 1.28.7-r0, istio-fips 1.30.0-r1, k8ssandra-operator 1.26.0-r0, knative-net-istio 1.20.4-r3, knative-net-istio 1.21.4-r3, knative-net-istio 1.22.1-r1, knative-net-istio 1.23.0-r0, knative-serving 1.20.3-r1, knative-serving 1.21.3-r2, knative-serving 1.22.1-r3, knative-serving 1.23.0-r0, kube-bench 0.15.0-r1, kube-metrics-adapter 0.2.9-r1, kube-rbac-proxy 0.20.2-r2, kube-rbac-proxy 0.21.2-r0, kube-rbac-proxy-fips 0.20.2-r2, kube-state-metrics 2.10.1-r2, kube-state-metrics 2.16.0-r10, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.18.0-r1, kube-state-metrics-fips 2.19.1-r0, kube-state-metrics-fips 2.20.0-r2, kube-vip 0.9.2-r1, kube-vip 1.0.4-r2, kube-vip 1.1.2-r4, kube-vip-fips 0.9.2-r1, kuberay-operator 1.3.2-r3, kuberay-operator 1.4.2-r3, kuberay-operator 1.5.2-r3, kuberay-operator 1.6.2-r2, kubernetes 1.33.13-r1, kubernetes 1.34.10-r5, kubernetes 1.35.7-r1, kubernetes 1.36.1-r0, kubernetes-csi-driver-nfs-fips 4.13.0-r3, kubernetes-csi-external-provisioner-fips 6.1.0-r4, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-csi-external-resizer-fips 2.1.0-r1, kubernetes-csi-external-snapshotter-fips 8.4.0-r4, kubernetes-csi-livenessprobe-fips 2.19.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r1, kubernetes-csi-node-driver-registrar-fips 2.15.0-r4, kubernetes-csi-node-driver-registrar-fips 2.16.0-r4, kubernetes-dashboard-metrics-scraper 1.2.2-r2, kubernetes-dashboard-metrics-scraper-fips 1.2.2-r1, kubernetes-dns-node-cache 1.23.1-r1, kubernetes-dns-node-cache 1.24.1-r2, kubernetes-dns-node-cache 1.25.0-r9, kubernetes-dns-node-cache 1.26.8-r7, kubernetes-event-exporter 1.7-r1, kubernetes-event-exporter-fips 1.7-r0, kubevela 1.10.8-r0, kubewatch 2.12.0-r1, kured 1.20.0-r0, kustomize-fips 5.8.1-r1, kyverno 1.18.1-r0, kyverno 1.18.1-r1, local-path-provisioner 0.0.36-r1, local-path-provisioner-fips 0.0.36-r3, local-static-provisioner 2.8.0-r2, logstash-exporter 1.6.4-r1, logstash-exporter 1.7.1-r2, logstash-exporter 1.8.4-r2, logstash-exporter 1.9.1-r4, logstash-exporter-fips 1.6.4-r1, logstash-exporter-fips 1.7.1-r1, lvm-driver 1.10.0-r4, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, melange 0.50.0-r1, melange 0.56.1-r1, memcached-exporter 0.16.0-r2, metacontroller 4.12.13-r1, metacontroller 4.13.1-r1, metacontroller 4.14.0-r1, metacontroller 4.15.0-r1, metallb 0.13.12-r5, metallb 0.14.9-r4, metallb 0.15.3-r2, metallb 0.16.0-r3, metallb 0.16.1-r0, metallb 0.16.1-r1, minio 0.20260330.001845-r0, minio-client 0.20250721.052808-r1, minio-operator 6.0.4-r7, minio-operator 7.0.1-r7, minio-operator 7.1.1-r4, minio-operator 7.1.1-r7, mongodb 7.0.32-r1, mongodb 8.0.20-r1, mongodb 8.0.21-r1, mongodb 8.0.29-r0, mongodb 8.1.3-r3, mongodb 8.2.6-r1, mongodb 8.3.2-r1, mongodb 8.3.8-r0, mountpoint-s3-csi-driver 2.3.0-r1, nats-streaming 0.22.1-r2, nats-streaming 0.25.6-r6, newrelic-infrastructure-agent 1.73.1-r1, newrelic-nri-kube-events 2.16.4-r2, nginx-prometheus-exporter-fips 1.5.3-r1, nvidia-device-plugin 0.19.2-r0, ollama 0.20.3-r3, ollama 0.23.4-r2, ollama 0.30.10-r0, ollama 0.31.2-r2, ollama 0.32.11-r2, ollama-fips 0.18.3-r1, ollama-fips 0.21.0-r2, ollama-fips 0.32.11-r2, ollama-fips 0.32.12-r1, ollama-fips 0.32.14-r1, ollama-fips 0.32.15-r2, opa 1.17.0-r1, opa-fips 1.19.1-r2, opentelemetry-collector-contrib 0.150.0-r0, opentelemetry-collector-contrib 0.156.0-r0, opentelemetry-collector-contrib-fips 0.158.0-r3, opentelemetry-collector-contrib-fips 0.159.0-r2, percona-server-mongodb-operator 1.22.0-r1, percona-server-mongodb-operator 1.23.0-r0, percona-xtradb-cluster-operator-fips 1.18.0-r5, policy-controller-fips 0.15.1-r1, postgres-operator 1.12.2-r2, postgres-operator 1.15.1-r1, prometheus 3.10.0-r8, prometheus 3.11.2-r0, prometheus 3.11.3-r6, prometheus 3.5.2-r1, prometheus-alertmanager 0.32.0-r1, prometheus-alertmanager 0.33.0-r2, prometheus-blackbox-exporter 0.28.0-r2, prometheus-fips 3.10.0-r2, prometheus-fips 3.11.3-r2, prometheus-fips 3.12.0-r3, prometheus-mongodb-exporter-fips 0.53.0-r1, prometheus-mysqld-exporter 0.15.0-r3, prometheus-mysqld-exporter 0.17.2-r5, prometheus-mysqld-exporter 0.18.0-r5, prometheus-mysqld-exporter 0.19.0-r4, prometheus-node-exporter 1.10.2-r4, prometheus-node-exporter 1.11.1-r3, prometheus-node-exporter 1.12.1-r1, prometheus-node-exporter 1.9.1-r4, prometheus-node-exporter-fips 1.11.1-r2, prometheus-operator 0.90.1-r3, prometheus-operator 0.91.0-r4, prometheus-operator 0.92.1-r2, prometheus-operator-fips 0.91.0-r0, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.8.0-r2, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r3, prometheus-pushgateway-fips 1.8.0-r2, prometheus-redis-exporter 1.86.0-r2, prometheus-redis-exporter 1.87.0-r1, prometheus-redis-exporter 1.88.0-r3, prometheus-redis-exporter-fips 1.87.0-r3, prometheus-statsd-exporter 0.27.2-r1, prometheus-statsd-exporter 0.28.0-r3, prometheus-statsd-exporter 0.29.0-r0, promxy-fips 0.0.93-r1, pulumi-kubernetes-operator 2.7.0-r0, rabbitmq-cluster-operator 2.18.0-r0, rabbitmq-cluster-operator 2.20.1-r6, rabbitmq-cluster-operator 2.21.1-r3, rabbitmq-cluster-operator 2.22.4-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, rabbitmq-messaging-topology-operator 1.18.3-r4, rabbitmq-messaging-topology-operator 1.19.2-r0, rabbitmq-messaging-topology-operator 1.19.3-r3, rabbitmq-messaging-topology-operator 1.2.1-r1, rancher-fleet-agent 0.12.17-r3, rancher-fleet-agent 0.13.13-r1, rancher-fleet-agent 0.14.10-r1, rancher-fleet-agent 0.14.8-r3, rancher-fleet-agent 0.15.4-r3, rancher-fleet-agent 0.15.6-r0, rancher-fleet-agent 0.16.1-r1, rclone 1.72.1-r12, rclone 1.73.5-r6, rclone 1.74.4-r1, renovate 44.31.0-r1, renovate 44.32.5-r2, restic 0.18.1-r5, restic-fips 0.18.1-r7, runc 1.4.2-r0, rundeck 6.0.0-r0, sealed-secrets 0.34.0-r0, sealed-secrets 0.35.0-r6, sealed-secrets 0.36.6-r1, sealed-secrets 0.36.6-r4, sealed-secrets 0.37.0.r2, sealed-secrets 0.38.4-r0, secrets-store-csi-driver-provider-gcp 1.15.0-r1, secrets-store-csi-driver-provider-gcp 1.17.0-r2, smarter-device-manager 1.1.2-r0, spire-server 1.13.5-r1, spire-server 1.14.5-r1, spire-server-fips 1.14.5-r1, stakater-reloader 1.1.0-r4, stakater-reloader 1.2.1-r3, stakater-reloader-fips 1.4.19-r1, step 0.27.5-r4, step 0.28.7-r5, step 0.29.0-r4, step-issuer 0.10.2-r5, step-issuer 0.11.0-r5, step-issuer 0.9.11-r3, syft 1.45.0-r2, tekton-chains-fips 0.24.0-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tekton-pipelines-fips 1.13.1-r2, tekton-pipelines-fips 1.14.0-r4, tempo 2.10.4-r1, temporal 1.5.1-r0, temporal-server 1.28.4-r2, temporal-server 1.29.7-r1, temporal-server 1.30.5-r1, temporal-server 1.30.6-r3, temporal-server 1.31.0.153.1-r0, temporal-ui-server-fips 2.48.4-r1, temporal-ui-server-fips 2.49.1-r1, temporal-ui-server-fips 2.50.1-r1, temporal-ui-server-fips 2.51.1-r1, terraform 1.15.7-r0, tigera-operator 1.42.1-r3, tigera-operator-fips 1.37.2-r4, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1, tkn 0.45.0-r1, tkn 0.46.0-r1, tkn-fips 0.44.2-r0, trino 480-r10, trust-manager 0.21.1-r2, trust-manager 0.22.1-r3, trust-manager 0.23.0-r1, trust-manager 0.24.0-r1, trust-manager-fips 0.20.3-r2, trust-manager-fips 0.21.1-r2, vault 1.19.5-r3, vault 1.20.4-r9, vault 1.21.4-r10, vault 2.0.0-r1, vault-k8s 1.4.2-r2, vault-k8s 1.5.0.r3, vault-k8s 1.6.2-r2, vault-k8s 1.7.4-r0, vault-k8s 1.7.6-r0, velero 1.15.2-r7, velero 1.17.2-r8, velero 1.18.1-r0, velero 1.18.2-r7, velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.12.2-r9, velero-plugin-for-aws 1.13.2-r4, velero-plugin-for-aws 1.14.1-r1, velero-plugin-for-aws 1.14.2-r1, velero-plugin-for-aws-fips 1.13.2-r1, velero-plugin-for-aws-fips 1.14.2-r1, velero-plugin-for-csi 0.4.3-r5, velero-plugin-for-csi 0.6.3-r3, velero-plugin-for-gcp-fips 1.14.1-r1, victoriametrics-operator 0.69.0-r1, victoriametrics-operator 0.71.0-r2, victoriametrics-operator-fips 0.68.5-r0, victoriametrics-operator-fips 0.69.0-r0, victoriametrics-operator-fips 0.70.1-r0, victoriametrics-operator-fips 0.71.0-r0, wave 0.10.0-r5, wave 0.8.0-r2, wave 0.9.0-r2, wave 011.0-r4, weaviate 1.37.4-r1, weaviate 1.37.6-r1, weaviate-fips 1.36.17-r0, weaviate-fips 1.37.9-r0, weaviate-fips 1.38.1-r0, weaviate-fips 1.38.10-r2, weaviate-fips 1.38.11-r2, whereabouts 0.9.2-r2, yunikorn-k8shim 1.5.2-r1

CVE-2026-39821 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WL31691 Security fix for CVE-2026-25680 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300066.1-r1, apache-nifi 2.10.0-r4, apko 1.2.13-r0, argo-cd 3.2.7-r3, argo-cd 3.3.5-r2, argo-workflows 4.0.5-r0, authservice 1.1.5-r1, authservice 1.1.6-r1, aws-load-balancer-controller 3.2.0-r0, aws-network-policy-agent 1.3.2-r1, aws-network-policy-agent-fips 1.3.2-r0, cadvisor 0.55.1-r1, cadvisor 0.57.0-r0, cadvisor-fips 0.55.1-r0, cert-manager 1.17.4-r2, cert-manager 1.18.6-r1, cert-manager 1.20.0-r0, cert-manager 1.20.2-r0, cert-manager-webhook-pdns-fips 2.5.5-r1, cfssl 1.5.0-r1, cloudnative-pg 1.29.1-r0, cloudnative-pg 1.29.1-r2, cloudprober 0.14.3-r1, cluster-autoscaler 1.35.2-r2, consul 2.0.1-r0, cortex 1.21.0-r2, cosign 3.0.6-r1, dex 2.44.0-r3, dex 2.45.1-r3, dynatrace-operator 1.6.3-r1, elastic-beats 9.2.8-r2, elastic-beats 9.4.0-r2, elastic-beats-fips 9.2.8-r0, external-secrets-fips 0.17.0-r2, external-secrets-operator 2.5.0-r1, external-secrets-operator 2.6.0-r1, fluent-operator 3.9.0-r2, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r1, fulcio-fips 1.7.1-r3, gostatsd 28.3.0-r2, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, grafana-org-operator 1.13.0-r0, haproxy-ingress 0.14.12-r1, helm 4.0.5-r2, helm-operator 1.42.2-r0, ingress-nginx-controller 1.14.5-r1, istio 1.27.9-r1, istio 1.29.2-r1, istio-fips 1.26.8-r4, istio-fips 1.27.9-r2, istio-fips 1.28.7-r0, istio-fips 1.30.0-r1, k8ssandra-operator 1.26.0-r0, kube-bench 0.15.0-r1, kube-rbac-proxy 0.20.2-r2, kube-rbac-proxy 0.21.2-r0, kube-rbac-proxy-fips 0.20.2-r2, kube-state-metrics 2.10.1-r2, kube-state-metrics-fips 2.18.0-r1, kube-vip 1.1.0-r1, kuberay-operator 1.3.2-r3, kuberay-operator 1.4.2-r3, kuberay-operator 1.5.2-r3, kuberay-operator 1.6.2-r2, kubernetes 1.36.1-r0, kubernetes-csi-driver-nfs-fips 4.13.0-r3, kubernetes-csi-external-provisioner-fips 6.1.0-r4, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-csi-external-resizer-fips 2.1.0-r1, kubernetes-csi-external-snapshotter-fips 8.4.0-r4, kubernetes-csi-livenessprobe-fips 2.19.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r1, kubernetes-csi-node-driver-registrar-fips 2.15.0-r5, kubernetes-csi-node-driver-registrar-fips 2.16.0-r4, kubernetes-dashboard-metrics-scraper 1.2.2-r2, kubernetes-dashboard-metrics-scraper-fips 1.2.2-r1, kubernetes-event-exporter 1.7-r1, kubernetes-event-exporter-fips 1.7-r0, kubevela 1.10.8-r0, kubewatch 2.12.0-r1, kured 1.20.0-r0, kyverno 1.18.1-r0, kyverno 1.18.1-r1, local-path-provisioner 0.0.36-r1, local-path-provisioner-fips 0.0.36-r1, local-static-provisioner 2.8.0-r2, lvm-driver 1.10.0-r4, melange 0.50.0-r1, melange 0.56.1-r1, memcached-exporter 0.16.0-r0, metacontroller 4.12.13-r1, metacontroller 4.13.1-r1, metacontroller 4.14.0-r1, metacontroller 4.15.0-r1, metallb 0.16.1-r0, metallb 0.16.1-r1, minio-client 0.20250721.052808-r1, minio-operator 7.1.1-r4, mongodb 7.0.32-r1, mongodb 8.0.20-r1, mongodb 8.0.21-r1, mongodb 8.2.6-r1, mongodb 8.3.2-r1, mountpoint-s3-csi-driver 2.3.0-r1, newrelic-infrastructure-agent 1.73.1-r1, newrelic-nri-kube-events 2.16.4-r2, nvidia-device-plugin 0.19.2-r0, ollama 0.20.3-r3, ollama 0.23.4-r2, ollama 0.30.10-r0, ollama 0.31.2-r2, ollama 0.32.11-r2, ollama-fips 0.18.3-r1, ollama-fips 0.21.0-r2, ollama-fips 0.32.11-r2, opa 1.17.0-r1, percona-server-mongodb-operator 1.22.0-r1, percona-server-mongodb-operator 1.23.0-r0, percona-xtradb-cluster-operator-fips 1.18.0-r5, policy-controller-fips 0.15.1-r1, postgres-operator 1.12.2-r2, postgres-operator 1.15.1-r1, prometheus 3.11.2-r0, prometheus 3.5.2-r1, prometheus-alertmanager 0.32.0-r1, prometheus-blackbox-exporter 0.28.0-r2, prometheus-node-exporter-fips 1.11.1-r1, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.8.0-r2, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r1, prometheus-pushgateway-fips 1.8.0-r2, promxy-fips 0.0.93-r1, pulumi-kubernetes-operator 2.7.0-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, rabbitmq-messaging-topology-operator 1.19.2-r0, rancher-fleet-agent 0.12.17-r3, rancher-fleet-agent 0.13.13-r0, rancher-fleet-agent 0.14.10-r1, rancher-fleet-agent 0.14.8-r3, rancher-fleet-agent 0.15.4-r3, rancher-fleet-agent 0.15.6-r0, rancher-fleet-agent 0.16.1-r1, restic-fips 0.18.1-r7, runc 1.4.2-r0, rundeck 6.0.0-r0, sealed-secrets 0.34.0-r0, sealed-secrets 0.35.0-r4, sealed-secrets 0.36.6-r1, secrets-store-csi-driver-provider-gcp 1.15.0-r1, secrets-store-csi-driver-provider-gcp 1.17.0-r2, smarter-device-manager 1.1.2-r0, spire-server 1.13.5-r1, spire-server 1.14.5-r1, spire-server-fips 1.14.5-r1, stakater-reloader 1.2.1-r0, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, syft 1.45.0-r2, tempo 2.10.4-r1, temporal 1.5.1-r0, temporal-server 1.31.0.153.1-r0, temporal-ui-server-fips 2.51.1-r1, tigera-operator 1.42.0-r0, tigera-operator-fips 1.37.2-r4, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.45.0-r1, trust-manager 0.22.1-r2, trust-manager-fips 0.20.3-r2, trust-manager-fips 0.21.1-r2, vault 1.20.4-r5, vault 1.21.4-r5, vault 2.0.0-r1, vault-k8s 1.7.4-r0, velero 1.18.1-r0, velero-plugin-for-aws 1.12.2-r6, velero-plugin-for-aws 1.14.1-r1, velero-plugin-for-aws-fips 1.13.2-r1, velero-plugin-for-aws-fips 1.14.2-r1, velero-plugin-for-gcp-fips 1.14.1-r1, victoriametrics-operator 0.69.0-r1, wave 0.11.0-r2, weaviate 1.37.4-r1, weaviate 1.37.6-r1, weaviate-fips 1.36.17-r0, weaviate-fips 1.37.9-r0, weaviate-fips 1.38.1-r0, whereabouts 0.9.2-r2, yunikorn-k8shim 1.5.2-r1

CVE-2026-25680 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

📄 Hibernate ORM 5.6.15 SQL Injection

Hibernate ORM versions 5.6.15 and below suffer from a remote SQL injection vulnerability. CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview...

EUVD-2024-22480

Malicious code in bioql PyPI...

CVE-2024-25130

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is use...

CVE-2024-25130 Tuleap's mass update clears the permissions on artifact field

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is use...

CVE-2024-25130

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is use...

CVE-2024-25130 Tuleap's mass update clears the permissions on artifact field

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is use...

CVE-2024-25130: Exposure of Sensitive Information to an Unauthorized Actor

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is use...

PT-2024-20770 · Unknown · Tuleap Community Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 15.5.99.76 Tuleap Enterprise Edition versions prior to 15.5-4 Tuleap Enterprise Edition versions prior to 15.4-7 Description: Tuleap is an open source suite to improve management of software...

CVE-2022-29414

Multiple 13x Cross-Site Request Forgery CSRF vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin mass update settings, manage subscriptions add a new subscription, update subscription, delete Subscription...