CVE-2026-59898 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter, apache-activemq-artemis, celeborn, tez, apache-nifi, flyway, keycloak, wavefront-proxy, druid, neo4j, akhq, apicurio-registry, opensearch, strimzi-kafka-operator, spark, apache-pulsar, infinispan, logstash, kserve-modelmesh,...

GO-2026-5884 ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go

ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go...

GO-2026-5885 Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go

Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go...

GHSA-R292-9MHP-454M node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

Summary node-tar npm tar contains an uncontrolled-recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. When a consumer calls tar.t... or tar.x... with a non-empty member-selection list, node-tar installs a filter that closes over the recursive mapHas src/list.ts:33-44...

CVE-2026-54422

A flaw was found in OpenStack ironic-python-agent's bootc container deployment support. During bootc image deployment, the OCI registry pull secret was exposed to tenant-controlled container code running with host PID namespace visibility. A malicious bootc container image could read the operator...

CVE-2026-59901 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter, apache-activemq-artemis, celeborn, tez, apache-nifi, flyway, keycloak, wavefront-proxy, druid, neo4j, akhq, apicurio-registry, cassandra-reaper, opensearch, strimzi-kafka-operator, spark, apache-pulsar, infinispan, cassandra, logstash,...

GHSA-558V-64GR-WGG4 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter, apache-activemq-artemis, celeborn, tez, apache-nifi, flyway, keycloak, wavefront-proxy, druid, neo4j, akhq, apicurio-registry, cassandra-reaper, opensearch, strimzi-kafka-operator, spark, apache-pulsar, infinispan, cassandra, logstash,...

GHSA-558V-64GR-WGG4 vulnerabilities

Vulnerabilities for packages: traccar-fips, s3proxy, request-9047-keycloak-fips, cassandra, floci, infinispan, keycloak, floci-az, conductor-fips, seata, grpc-java-fips, cassandra-reaper, knative-kafka-broker-fips, opensearch-fips, elasticsearch-fips, neo4j, celeborn,...

CVE-2026-59901 vulnerabilities

Vulnerabilities for packages: traccar-fips, s3proxy, request-9047-keycloak-fips, cassandra, floci, infinispan, keycloak, floci-az, conductor-fips, seata, grpc-java-fips, cassandra-reaper, knative-kafka-broker-fips, opensearch-fips, elasticsearch-fips, neo4j, celeborn,...

Important: Red Hat Security Advisory: satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-advisor-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. This adds the satellite/iop-advisor-engine-rhel9 image to the Red Hat container registry. To pull this container image, run the following command: podman pull...

Exploit for CVE-2026-56121

CVE-2026-56121 — Feast Registry Unauthenticated RCE dill.load...

EUVD-2026-47593

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16489

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

OPENSUSE-SU-2026:11328-1 distribution-registry-3.1.1-4.1 on GA media

These are all security issues fixed in the distribution-registry-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-64053

These are all security issues fixed in the distribution-registry-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-16489

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16489 jsforce SFDX Connection Registry sfdx.js _execCommand os command injection

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16489

CVE-2026-16489 affects jsforce up to 3.10.16 in the SFDX Connection Registry. The vulnerability targets the function _execCommand within lib/registry/sfdx.js, enabling OS command injection from a local environment. An exploit is publicly available; the issue was reported early but no remediation ...

CVE-2026-16489 jsforce SFDX Connection Registry sfdx.js _execCommand os command injection

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea's Debian package registry parser contains an unbounded decompression vulnerability in ParseControlFile. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the entire uncompressed stream into a strings.Builder via a TeeReader, with no limit on how much...