GHSA-P9JG-FCR6-3MHF OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms

Summary A flaw in com.ongres.scram:scram-client allows an attacker capable of performing a TLS man-in-the-middle MITM attack to silently downgrade a connection from SCRAM-SHA-256-PLUS with channel binding to standard SCRAM-SHA-256 without channel binding, bypassing strict client-side enforcement...

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share the same downstream clusters e.g., different privileged or untrusted teams inside the same organization. On unpatched versions, tenants could bypass restrictions to access any conf...

CVE-2026-49835 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, kyverno-notation-aws, trivy-operator, kyverno, gitsign, ratify, spire-server, tekton-chains, falcoctl, aactl, kubescape, tflint, trivy, zarf, goreleaser, policy-controller, crossplane, tkn...

GHSA-9C54-X2G4-V92J vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, kyverno-notation-aws, trivy-operator, kyverno, gitsign, ratify, spire-server, tekton-chains, falcoctl, aactl, kubescape, tflint, trivy, zarf, goreleaser, policy-controller, crossplane, tkn...

GHSA-97VG-427P-8HX5 SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect

SurrealDB offers http:: functions that can access external network endpoints, with the --allow-net and --deny-net capabilities used to restrict the set of network targets that can be reached. An authenticated user of SurrealDB can bypass a port-scoped --deny-net : rule by chaining an HTTP redirec...

sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

Summary The documented certificateOIDs option in sigstore.verify is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked. Details The public verify options include certificateOIDs and the documentation says those OID/value pairs...

GHSA-52V5-JR5W-GJXR sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

Summary The documented certificateOIDs option in sigstore.verify is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked. Details The public verify options include certificateOIDs and the documentation says those OID/value pairs...

Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact 7.1.1.0

Summary Multiple vulnerabilities were addressed in IBM Tivoli Netcool Impact version 7.1.1.1 Vulnerability Details CVEID:CVE-2026-42198 DESCRIPTION: pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of...

External Control of File Name or Path

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

External Control of File Name or Path

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the -concatenate operation due to missing policy checks. An attacker can access or modify files outside of intended directories by leveraging this operation to bypass security policies...

External Control of File Name or Path

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

CVE-2026-55628

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been...

DEBIAN-CVE-2026-55628

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been...

AZL-90164 CVE-2026-50195 affecting package containerd2 for versions less than 2.2.4-3

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods ca...

CVE-2026-55628

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been...

UBUNTU-CVE-2026-55628

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been...

Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

Description The per-template filter, tag and function allow-list check is compiled into the checkSecurity method of each Template subclass and was invoked once from the constructor, gated by SandboxExtension::isSandboxed$source. Template instances are then cached on the Environment in...

GHSA-529H-VH3J-85HQ Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

Description The per-template filter, tag and function allow-list check is compiled into the checkSecurity method of each Template subclass and was invoked once from the constructor, gated by SandboxExtension::isSandboxed$source. Template instances are then cached on the Environment in...

Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency

A flaw was found in Node.js. An inconsistency in how Node.js matches hostnames can be exploited by a remote attacker in multi-context mTLS mutual Transport Layer Security setups. This vulnerability allows for a trust-policy bypass, potentially leading to unauthorized access to sensitive informati...