CLEANSTART-2026-MH83831 Security fixes in pulumi-language-dotnet 3.103.0-r1

Package pulumi-language-dotnet version 3.103.0-r1 fixes 1 vulnerabilities: ghsa-3xc5-wrhm-f963...

CLEANSTART-2026-CX37919 Security fixes in prometheus-mysqld-exporter-fips 0.19.0-r0

Package prometheus-mysqld-exporter-fips version 0.19.0-r0 fixes 1 vulnerabilities: CVE-2026-26958...

CLEANSTART-2026-UJ52538 Security fixes in hunspell 1.7.0-r1

Package hunspell version 1.7.0-r1 fixes 1 vulnerabilities: CVE-2019-16707...

CLEANSTART-2026-ZV66628 Security fixes in terragrunt-fips 0.99.5-r1

Package terragrunt-fips version 0.99.5-r1 fixes 1 vulnerabilities: ghsa-3xc5-wrhm-f963...

CLEANSTART-2026-QR91336 Security fixes in kube-vip-fips 0.8.10-r0

Package kube-vip-fips version 0.8.10-r0 fixes 1 vulnerabilities: ghsa-6v2p-p543-phr9...

CLEANSTART-2026-QI45385 Security fixes in k8s-sidecar 2.7.1-r1

Package k8s-sidecar version 2.7.1-r1 fixes 1 vulnerabilities: CVE-2026-8643...

CLEANSTART-2026-FH31157 Security fixes in prometheus-nats-exporter 0.15.0-r0

Package prometheus-nats-exporter version 0.15.0-r0 fixes 1 vulnerabilities: ghsa-fhg8-qxh5-7q3w...

CLEANSTART-2026-JG51034 Security fixes in nodejs 10.15.3-r0

Package nodejs version 10.15.3-r0 fixes 1 vulnerabilities: CVE-2019-5737...

CLEANSTART-2026-HB13446 Security fixes in consul 1.21.5-r5

Package consul version 1.21.5-r5 fixes 1 vulnerabilities: CVE-2026-2303...

Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3418-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2: Use proper obs time form...

CVE-2026-13584

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, Block-type remo...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14305

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

CVE-2026-14188

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-15382

The CVE concerns the Ultimate Addons for WPBakery Page Builder WordPress plugin (before version 3.21.4). The vulnerability arises because there is no capability or nonce check when deleting a site’s custom-uploaded icon font packs, allowing an unauthenticated attacker to permanently delete all cu...

CVE-2026-17975

An inappropriate implementation flaw was found in the IME component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=519233776...

gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb

A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a...