CVE-2026-41187

Summary: Calico’s apiserver fails to invoke the Delete override for DeleteCollection on tier-scoped policies (NetworkPolicy, GlobalNetworkPolicy and staged variants). This allows a user with deletecollection or wildcard verbs on tier-scoped policy resources to bulk-delete policies in tiers they w...

EUVD-2026-51153

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard...

CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-6540

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-52863

A flaw was found in Unbound, a validating, recursive, and caching Domain Name System DNS resolver. When configured with specific modules and under heavy load, a memory corruption vulnerability can occur due to improper handling of view names during subquery processing. This issue could lead to a...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization due to the full-scope-disabled client-policy executor. An attacker can create a client...

OPENSUSE-SU-2026:21489-1 Security update for bind

This update for bind fixes the following issues - Upgrade to release 9.20.26 - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exit bsc1271983. - CVE-2026-11331: Potential wildcard CNAME RPZ policy...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization during client update handling. An attacker can persist a confidential client that does...

CVE-2026-17953

An insufficient policy enforcement flaw was found in the WebView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517335150...

CVE-2026-17882

A policy bypass flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523637452...

CVE-2026-17829

An insufficient policy enforcement flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517705103...

CVE-2026-17776

A policy bypass flaw was found in the Receiver component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513404032...

CLEANSTART-2026-WA03770 Security fixes in kyverno-policy-reporter-fips 3.3.3-r4

Package kyverno-policy-reporter-fips version 3.3.3-r4 fixes 5 vulnerabilities: CVE-2026-25679, ghsa-p77j-4mvh-x3m3, CVE-2026-33186, CVE-2026-27139, CVE-2026-27142...

CLEANSTART-2026-RB15576 Security fixes in kyverno-policy-reporter-fips 3.7.3-r1

Package kyverno-policy-reporter-fips version 3.7.3-r1 fixes 3 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-34986, CVE-2026-39883...

CLEANSTART-2026-XS28116 Security fixes in kyverno-policy-reporter-fips 3.5.0-r0

Package kyverno-policy-reporter-fips version 3.5.0-r0 fixes 1 vulnerabilities: ghsa-2464-8j7c-4cjm...

CLEANSTART-2026-RU30186 Security fixes in kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r6

Package kyverno-policy-reporter-kyverno-plugin-fips version 1.4.2-r6 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-25679, CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-ZU68768 Security fixes in aws-network-policy-agent 1.3.2-r1

Package aws-network-policy-agent version 1.3.2-r1 fixes 21 vulnerabilities: CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-25680...

CLEANSTART-2026-TH50881 Security fixes in aws-network-policy-agent-fips 1.3.2-r0

Package aws-network-policy-agent-fips version 1.3.2-r0 fixes 21 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-25681, CVE-2026-42502, CVE-2026-42504, CVE-2026-42505...

CLEANSTART-2026-YS85875 Security fixes in policy-controller 0.12.1-r1

Package policy-controller version 0.12.1-r1 fixes 13 vulnerabilities: CVE-2025-8556, CVE-2026-1229, CVE-2025-15558, CVE-2025-46569, CVE-2026-22703...