GO-2026-6889 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-csi-driver, aws-privateca-issuer, kuberay-operator, percona-server-mongodb-operator, cert-manager-cmctl, step-issuer, cert-manager-istio-csr, mariadb-operator...

GO-2026-6889 vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, athenz-cert-manager-issuer, cert-manager-openshift-routes, mariadb-operator-fips, aws-privateca-issuer, cert-manager-istio-csr, cert-manager-cmctl-fips, aws-privateca-issuer-fips, cert-manager-openshift-routes-fips, cert-manager-csi-driver,...

PT-2026-118511

Name of the Vulnerable Software and Affected Versions @apostrophecms/import-export versions prior to 3.7.0 Description An authenticated user with import access to a target type can manipulate the update-by-key feature to modify documents they did not explicitly identify. The getUpdateKey and...

PT-2026-120315

Summary @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property for example slug:key whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey/insertOrUpdateDocWithKey lib/methods/import.js use that value...

CVE-2026-55253

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list, MongoDBSaver.alist, and MongoDBStore.search incorporate filter dictionaries into MongoDB queries without...

CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object e.g. "$gt": "4" can be substituted for ...

CVE-2026-65645

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object e.g. "$gt": "4" can be substituted for ...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, cert-manager-csi-driver, aws-privateca-issuer, percona-server-mongodb-operator, opentelemetry-operator, cert-manager-cmctl, step-issuer, cert-manager-istio-csr, mariadb-operator...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: jaeger-operator, kube-logging-operator, opa-envoy, litefs, hcloud, mattermost, apache-exporter, external-secrets-operator, conjur-cli, go, rook, vcluster, cass-operator, crossplane-provider-aws-dynamodb, steampipe, step-ca, crossplane-provider-aws-cloudformation,...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: kubernetes-ingress-defaultbackend, bom, opentelemetry-collector, conjur-cli, sftpgo-plugin-eventsearch, step-ca, sftpgo-plugin-pubsub, vale, terraform-provider-tls, crane, vault-secrets-webhook, pulumi-language-java, scorecard, secrets-store-csi-driver-provider-aws,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: juicefs, ferretdb, yunikorn-k8shim, kube-logging-operator, sonobuoy, litefs, bom, mattermost, apache-exporter, conjur-cli, kubernetes-dashboard-metrics-scraper, gitleaks, kubelet-csr-approver, step, cass-operator, docker-credential-ecr-login,...

CLEANSTART-2026-SP46945 Security fixes in percona-server-mongodb-operator 1.23.0-r0

Package percona-server-mongodb-operator version 1.23.0-r0 fixes 22 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-CN16573 Security fixes in percona-server-mongodb-operator 1.22.0-r1

Package percona-server-mongodb-operator version 1.22.0-r1 fixes 32 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-BE68531 Security fixes for CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-33814, CVE-2026-35469, CVE-2026-39821, CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-pc3f-x583-g7j2, ghsa-pjcq-xvwq-hhpj applied in versions: 1.22.0-r1

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63666

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KJ85611 Security fixes for CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-33814, CVE-2026-35469, CVE-2026-39821, CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-pc3f-x583-g7j2, ghsa-pjcq-xvwq-hhpj applied in versions: 1.22.0-r1

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WA48911 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: juicefs, terraform, yunikorn-k8shim, kyverno-notation-aws, external-secrets-operator, cert-manager-cmctl, rancher-webhook, harbor, k6, cert-manager-istio-csr, dex, rancher, gitlab-runner, percona-server-mongodb-operator, grafana, opentofu, ratify, cert-manager,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: juicefs, terraform, yunikorn-k8shim, kyverno-notation-aws, external-secrets-operator, cert-manager-cmctl, rancher-webhook, harbor, k6, cert-manager-istio-csr, dex, rancher, gitlab-runner, percona-server-mongodb-operator, grafana, opentofu, ratify, cert-manager,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: flux, ratify, rancher-agent, versitygw, elastic-agent, k6, kyverno-notation-aws-fips, commercial-kyverno, minio, cert-manager-csi-driver, neuvector-fips, dex-fips, gitlab-runner, k6-fips, openbao, cert-manager-istio-csr-fips, commercial-grafana, xeol, seaweedfs-fips,...