NetApp StorageGRID 安全漏洞

NetApp StorageGRID is a object storage solution developed by the American network equipment company NetApp. Versions of NetApp StorageGRID prior to 11.9.0.13 and 12.0.0.6 contained security vulnerabilities. These vulnerabilities were due to information leakage issues, which could allow authorized...

OPENSUSE-SU-2026:20555-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: Update to google-cloud-sap-agent 3.12 bsc1259816: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header bsc1260265. Changes for google-cloud-sap-agent: Collect...

SUSE-SU-2026:21210-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: Update to google-cloud-sap-agent 3.12 bsc1259816: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header bsc1260265. Changes for google-cloud-sap-agent: Collect...

CVE-2026-40890 vulnerabilities

Vulnerabilities for packages: temporal, kube-metrics-adapter, temporal-ui-server, snyk-cli, fq...

GHSA-77FJ-VX54-GVH7 vulnerabilities

Vulnerabilities for packages: temporal, kube-metrics-adapter, temporal-ui-server, snyk-cli, fq...

CVE-2026-40890 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter-fips, kube-metrics-adapter, gotenberg, fq, temporal, temporal-ui-server-fips, temporal-ui-server, temporal-fips, snyk-cli...

GHSA-77FJ-VX54-GVH7 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter-fips, kube-metrics-adapter, gotenberg, fq, temporal, temporal-ui-server-fips, temporal-ui-server, temporal-fips, snyk-cli...

BIT-AUTHENTIK-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

[SECURITY] Fedora 42 Update: perl-Devel-Cover-1.44-7.fc42

This module provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code. By using Devel::Cover you can discover areas of code not exercised by your tests and determine which tests to create to increase coverage. Code coverage can be considered as an...

MLDAS: Machine Learning Dynamic Algorithm Selection for Software-Defined Networking Security

Network security is a critical concern in the digital landscape of today, with users demanding secure browsing experiences and protection of their personal data. This study explores the dynamic integration of Machine Learning ML algorithms with Software-Defined Networking SDN controllers to enhan...

CVE-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

CVE-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

GHSA-VFFH-X6R8-XX99 Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Impact Stored cross-site scripting XSS via crafted metric names in the Prometheus web UI: Old React UI + New Mantine UI: When a user hovers over a chart tooltip on the Graph page, metric names containing HTML/JavaScript are injected into innerHTML without escaping, causing arbitrary script...

[SECURITY] Fedora 42 Update: mupdf-1.26.3-6.fc42

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kaf, mcp-grafana, task, certificate-transparency, go-licenses, crossplane-provider-azure-managedidentity, croc, slsa-verifier, trivy-operator, cluster-proportional-autoscaler, wal-g, helm-push, cis-operator, kubernetes-dashboard-web, kapp, mesosphere-vsphere-csi,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: kaf, mcp-grafana, task, certificate-transparency, go-licenses, crossplane-provider-azure-managedidentity, croc, slsa-verifier, trivy-operator, cluster-proportional-autoscaler, wal-g, helm-push, cis-operator, kubernetes-dashboard-web, kapp, mesosphere-vsphere-csi,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: rke2-runtime, k8ssandra-client-fips, calico, gatekeeper, kepler, crossplane-provider-aws-servicediscovery, eks-node-monitoring-agent-fips, k8s-device-plugin, nri-cassandra, yq, mesosphere-vsphere-csi-fips, spicedb-operator, task-fips, flux-operator-fips,...

CLEANSTART-2026-NG75665 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the kube-state-metrics package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-BM53321 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the kube-state-metrics package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...