CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-61604

Prior to v8.0.0 , the ixo Blockchain (Layer 1) x/bonds module contained a flaw where funds could be moved from addresses resolved via DID verification methods without verifying ownership by the transaction signer. An attacker could register a victim's address as a verification method on their own...

CLEANSTART-2026-QE34516 Security fix for CVE-2025-46817 applied in: redis 7.2.11-r0, redis 7.4.6-r0, redis 8.0.4-r0, redis 8.2.2-r0

CVE-2025-46817 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KS06935 Security fix for GHSA-92mm-2pjq-r785 applied in: atlantis-fips 0.41.0-r0, opentofu-fips 1.10.9-r5, opentofu-fips 1.11.5-r4, opentofu-fips 1.11.6-r0, syft 1.42.4-r0, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.97.2-r5, terragrunt-fips 0.98.0-r5, terragrunt-fips 0.99.5-r0

GHSA-92mm-2pjq-r785 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LM41855 Security fix for CVE-2026-33812 applied in: gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, mailpit 1.29.6-r0, mailpit-fips 1.29.6-r0, ollama 0.20.3-r1, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.18.3-r0, ollama-fips 0.21.0-r0, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-33812 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD57328 Security fix for CVE-2026-44903 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300069.0-r1, certificate-transparency-trillian-ctserver 1.3.2-r2, certificate-transparency-trillian-ctserver-fips 1.3.2-r0, elastic-beats 9.2.8-r6, grafana 12.2.10-r1, grafana 12.3.10-r1, grafana 12.4.7-r1, grafana 12.4.9-r1, grafana 13.0.5-r1, grafana 13.0.7-r1, helm-operator-fips 1.41.1-r2, istio 1.29.2-r1, istio-fips 1.30.0-r0, istio-pilot-discovery 1.28.3-r1, istio-pilot-discovery-fips 1.28.3-r1, keda 2.19.0-r3, keda-fips 2.18.3-r3, keda-fips 2.19.0-r2, metrics-server 0.8.1-r5, pmm 3.5.0-r0, prometheus-operator 0.69.1-r1, prometheus-operator 0.87.1-r3, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.8.0-r3, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r1, prometheus-pushgateway-fips 1.8.0-r2, tempo 2.10.4-r1

CVE-2026-44903 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD10863 Security fix for CVE-2026-45674 applied in: apache-hive 4.2.0-r5, apache-nifi 2.9.0-r1, elasticsearch 9.2.7-r0, elasticsearch 9.2.8-r0, elasticsearch 9.3.5-r2, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.3.5-r3, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.7-r1, keycloak 26.6.3-r2, s3proxy 3.3.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-45674 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OD95693 Security fix for CVE-2026-44249 applied in: apache-hive 4.2.0-r5, apache-nifi 2.9.0-r1, apache-nifi-registry 2.9.0-r3, cassandra 5.0.8-r1, cassandra-reaper-fips 3.8.0-r9, cassandra-reaper-fips 4.0.2-r3, cassandra-reaper-fips 4.1.1-r3, cassandra-reaper-fips 4.2.5-r1, cloud-config-server 4.3.2-r3, elasticsearch 9.2.7-r0, elasticsearch 9.2.8-r0, elasticsearch 9.3.5-r2, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.3.5-r3, keycloak 26.4.10-r1, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.6-r6, keycloak 26.5.7-r1, keycloak 26.6.1-r3, keycloak 26.6.3-r2, kserve-modelmesh 0.12.0-r17, s3proxy 3.3.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, wildfly 41.0.0-r1

CVE-2026-44249 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TI03982 Security fix for GHSA-6v7p-g79w-8964 applied in: airflow-3 3.1.8-r5, airflow-3 3.2.1-r5, airflow-3 3.2.2-r1, apache-superset 5.0.0-r8, apache-superset 6.0.0-r6, miniforge3 25.11.0.1-r4, miniforge3 26.1.0.0-r4, miniforge3 26.1.1.0-r3, miniforge3 26.3.2.0-r0, py3.11-pip 26.2-r1

GHSA-6v7p-g79w-8964 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GK74613 Security fix for CVE-2026-55833 applied in: apache-activemq-artemis 2.56.0-r1, apache-nifi 2.10.0-r3, elasticsearch 9.1.10-r1, elasticsearch 9.2.8-r1, elasticsearch 9.3.5-r3, elasticsearch 9.3.8-r1, elasticsearch 9.4.4-r4, hazelcast 5.7.0-r1, keycloak 26.5.7-r7, keycloak 26.7.1-r0, logstash-fips 9.4.3-r1, strimzi-kafka-operator 1.1.0-r2

CVE-2026-55833 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ED75868 Security fix for GHSA-q98v-9f9w-f49q applied in: temporal-server 1.31.1-r5

Security vulnerability affects the temporal-server package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-90386

In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...

UBUNTU-CVE-2026-93164

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Move optimized uprobe from nop5 to nop10 Andrii reported an issue with optimized uprobes 1 that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data...

CVE-2026-93119

In the Linux kernel, the following vulnerability has been resolved: usb: ljca: bound banknum in ljcaenumerategpio ljcaenumerategpio reads desc-banknum from the device and loops validpini = getunalignedle32... for i banknum. validpin holds only LJCAMAXGPIONUM / 32 = 2 entries. Two checks run befor...

CVE-2026-93077

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxlgetfeature reads a feature in a loop but passes a fixed sizeout as the output capacity every iteration. On the last partial iteration the buffer has less room...

CVE-2026-93131

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-privacy: Fix race condition Accessing priv-featurespresent needs to happen with the list mutex being held, otherwise priv can be freed at any moment...

CVE-2026-93112

In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpfcpumaskpopulate bpfcpumaskpopulate writes to its destination with bitmapcopy, but the destination is typed as struct cpumask . That allows the verifier to accept borrowed cpumask pointers returne...

UBUNTU-CVE-2026-93123

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: do not advance stale DMA completions The qcom GENI serial DMA TX completion path advances the transmit fifo by the number of bytes recorded in port-txremaining. If uartflushbuffer runs after the hardware has...