CLEANSTART-2026-YH23797 Security fixes for CVE-2026-24051, CVE-2026-27143, CVE-2026-27144, CVE-2026-29181, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33186, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, ghsa-9h8m-3fm2-qjrq, ghsa-hfvc-g4fc-pqhx, ghsa-mh2q-q3fh-2475, ghsa-p77j-4mvh-x3m3 applied in versions: 1.30.0-r0, 1.30.0-r1

Multiple security vulnerabilities affect the cass-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: pulumi, dagger, teleport, kubevela, gitlab-runner, gptscript, argo-events, xeol, grafana-alloy, argocd-image-updater, pulumi-language-java, gomplate, goreleaser, wolfictl, bom, rancher-fleet, trivy-operator, argo-workflows, argo-cd, snyk-cli, kyverno,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: pulumi, dagger, teleport, kubevela, gitlab-runner, gptscript, argo-events, xeol, grafana-alloy, argocd-image-updater, pulumi-language-java, gomplate, goreleaser, wolfictl, bom, rancher-fleet, trivy-operator, argo-workflows, argo-cd, snyk-cli, kyverno,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: pulumi, dagger, teleport, kubevela, gitlab-runner, gptscript, argo-events, xeol, grafana-alloy, argocd-image-updater, pulumi-language-java, gomplate, goreleaser, wolfictl, bom, rancher-fleet, trivy-operator, argo-workflows, argo-cd, snyk-cli, kyverno,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: pulumi, dagger, teleport, kubevela, gitlab-runner, gptscript, argo-events, xeol, grafana-alloy, argocd-image-updater, pulumi-language-java, gomplate, goreleaser, wolfictl, bom, rancher-fleet, trivy-operator, argo-workflows, argo-cd, snyk-cli, kyverno,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, amazon-ssm-agent, kubevela, trivy-operator, rancher-fleet-fips, xeol-fips, xeol, kaniko-fips, kubescape-server, kyverno-fips, snyk-cli, pulumi-language-dotnet, cg, gptscript, packer, terragrunt-fips, gomplate-fips, gomplate, grafana-fips,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, amazon-ssm-agent, kubevela, trivy-operator, rancher-fleet-fips, xeol-fips, xeol, kaniko-fips, kubescape-server, kyverno-fips, snyk-cli, pulumi-language-dotnet, cg, gptscript, packer, terragrunt-fips, gomplate-fips, gomplate, grafana-fips,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, amazon-ssm-agent, kubevela, trivy-operator, rancher-fleet-fips, xeol-fips, xeol, kaniko-fips, kubescape-server, kyverno-fips, snyk-cli, pulumi-language-dotnet, cg, gptscript, packer, terragrunt-fips, gomplate-fips, gomplate, grafana-fips,...

GO-2026-4996 Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in github.com/grafana/tempo-operator

Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in github.com/grafana/tempo-operator...

Malicious code in vlifegram (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8771013473b84f29159a80ec15ce3e9897bc69908ddfa2438845811dd276d87c VLifeGram is published under its own name on PyPI but installs into the pyrogram/ namespace and ships a Pyrogram fork at version 2.1.2.4. It adds an...

EUVD-2026-31140

In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was restricted through srchFilter configurations on custom roles.The app contains an authorize.conf configuration file with a srchFilter entry that...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.12 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.12 and Red Hat build of Keycloak 26.4.12 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.16 Images Security Update

New images are available for Red Hat build of Keycloak 26.2.16 and Red Hat build of Keycloak 26.2.16 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: The correct message length must be passed to ip6 AppendData. l2tpip6sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To address this issu...

Astra Linux – Vulnerability in Vim

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804...

Astra Linux – Vulnerability in Mariadb 10.3

A issue in the component mydecimal::operator= of MariaDB Server v10.6.3 and below was discovered. This issue allows attackers to cause a Denial of Service DoS attack through specially crafted SQL statements...

PT-2026-42380

Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in github.com/grafana/tempo-operator...

Malicious code in clsx-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e4e85f63d161234d84c774fdff696827934a27282be2ce9ff362a756246ee6 On npm install, dist/postinstall.js base64-decodes the URL https://api.npoint.io/984b75c022a70cf00c39, fetches JSON from this anonymous mutable...

BIT-MONGODB-2026-8202 Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to...

n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

Summary When ENABLEMULTITENANT=true, the HTTP transport documents that the target n8n instance is selected per-request from x-n8n-url / x-n8n-key headers. Requests that omitted those headers — or supplied only one of them — silently fell back to the process-level N8NAPIURL / N8NAPIKEY credentials...