com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1 <=6.0.3-rc.1), com.arpnetworking.metrics:mad-experimental (>=1.2.4 <=1.2.11) +66 more potentially affected by CVE-2026-40490 via org.asynchttpclient:async-http-client (>=3.0.0.Beta1 <=3.0.7)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.Beta1, =6.0.1, =1.2.4, =1.22.5, =1.13.8, =1.1.0, =0.4.8, =0.4.8, =0.4.8, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =2.7.3, =218.0.0, =14.5.0, =16.0.0 and more Source cves: CVE-2026-40490 Source advisory: OSV:GHSA-CMXV-58FP-FM3G...

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

GHSA-VFFH-X6R8-XX99 Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

nimiq-client (>=0.1.0 <=0.2.0), nimiq-lib (>=0.1.0 <=0.2.0) +2 more potentially affected by CVE-2026-34069 via nimiq-consensus (>=0.1.0 <=0.2.0)

nimiq-consensus CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-34069 Source advisory: OSV:GHSA-48M6-486P-9J8P...

[SECURITY] Fedora 42 Update: mupdf-1.26.3-6.fc42

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: grafana-mimir, dask-gateway, terraform-docs, crossplane, direnv, configmap-reload, argo-rollouts, controller-gen, mariadb-operator, nri-prometheus, minio-object-browser, croc, tigera-operator, kafka-proxy, otel-cli, kserve-modelmesh-serving, nri-nginx,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: grafana-mimir, dask-gateway, terraform-docs, crossplane, direnv, configmap-reload, argo-rollouts, controller-gen, mariadb-operator, nri-prometheus, minio-object-browser, croc, tigera-operator, kafka-proxy, otel-cli, kserve-modelmesh-serving, nri-nginx,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: cni-plugins, sbomqs, pvc-autoresizer-fips, kube-vip-cloud-provider, multus-cni-fips, spire-controller-manager-fips, kcp, nvidia-container-toolkit, spegel-fips, gitlab-kas, buildtools, grpcurl, flannel-cni-plugin-fips, flux-notification-controller, elastic-agent,...

CLEANSTART-2026-NG75665 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the kube-state-metrics package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-BM53321 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the kube-state-metrics package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

CLEANSTART-2026-QN98167 html

Multiple security vulnerabilities affect the kube-state-metrics package. The html. See references for individual vulnerability details...

CLEANSTART-2026-WY13161 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the kube-state-metrics package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

ChatGPT, Is This Real? the Influence of Generative AI on Writing Style in Top-Tier Cybersecurity Papers

With the release of ChatGPT in 2022, generative AI has significantly lowered the cost of polishing and rewriting text. Due to its widespread usage, conference organizers instated specific requirements researchers need to adhere to when using GenAI. When asked to rewrite text, GenAI can introduce...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: docker-compose, keda, grafana-mimir, crossplane-provider-aws-memorydb, dgraph, tailscale, gomplate, gcp-compute-persistent-disk-csi-driver, argo-rollouts, helm-operator, kubernetes-csi-external-health-monitor, etcd, falco-no-driver, guac, ferretdb, jaeger, kuma, k9s,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: docker-compose, keda, grafana-mimir, crossplane-provider-aws-memorydb, dgraph, tailscale, gomplate, gcp-compute-persistent-disk-csi-driver, argo-rollouts, helm-operator, kubernetes-csi-external-health-monitor, etcd, falco-no-driver, guac, ferretdb, jaeger, kuma, k9s,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: ansible-operator, crossplane-provider-aws-ec2, kubeflow-pipelines, grype-fips, packer-fips, crossplane-provider-terraform, crossplane-provider-aws-guardduty-fips, newrelic-infrastructure-agent-fips, crossplane-provider-aws-s3, rabbitmq-cluster-operator-fips,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: ansible-operator, crossplane-provider-aws-ec2, kubeflow-pipelines, grype-fips, packer-fips, crossplane-provider-terraform, crossplane-provider-aws-guardduty-fips, newrelic-infrastructure-agent-fips, crossplane-provider-aws-s3, rabbitmq-cluster-operator-fips,...

GHSA-3CJC-VHFM-FFP2 Apache DolphinScheduler vulnerable to sensitive information disclosure

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.. Users are...

RLSA-2026:6388 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...

Cybersecurity Metrics Every CISO Should Report to the Board

Cybersecurity Metrics Every CISO Should Report to the Board After twenty years of leading security teams and presenting to boards at companies like Tripwire and RiskIQ, I can tell you this: the metrics that matter to your SOC team are not the metrics that matter in the boardroom. Boards do not wa...