CLEANSTART-2026-KC96979 Security fixes in temporal-server 1.31.1-r2

Package temporal-server version 1.31.1-r2 fixes 8 vulnerabilities: ghsa-q98v-9f9w-f49q, ghsa-hmhp-gh8m-c8xp, ghsa-p2gr-hm8g-q772, ghsa-xpg8-3hhp-p7w8, CVE-2025-14987...

CLEANSTART-2026-PF51019 Security fixes in temporal-server 1.31.1-r1

Package temporal-server version 1.31.1-r1 fixes 10 vulnerabilities: ghsa-q98v-9f9w-f49q, ghsa-hmhp-gh8m-c8xp, ghsa-p2gr-hm8g-q772, ghsa-xpg8-3hhp-p7w8, CVE-2025-14987...

CLEANSTART-2026-ZB13095 Security fixes in temporal-server-fips 1.31.1-r1

Package temporal-server-fips version 1.31.1-r1 fixes 5 vulnerabilities: CVE-2026-41602, ghsa-wf45-q9ch-q8gh, ghsa-p77j-4mvh-x3m3, CVE-2026-27145, CVE-2026-33811...

CLEANSTART-2026-IZ19721 Security fixes in temporal-server 1.31.1-r5

Package temporal-server version 1.31.1-r5 fixes 9 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-5724, ghsa-q98v-9f9w-f49q, ghsa-hmhp-gh8m-c8xp, ghsa-p2gr-hm8g-q772...

CLEANSTART-2026-UG13000 Security fixes in temporal-ui-server-fips 2.51.1-r1

Package temporal-ui-server-fips version 2.51.1-r1 fixes 36 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-JS88744 Security fixes in temporal-server 1.31.1-r4

Package temporal-server version 1.31.1-r4 fixes 8 vulnerabilities: CVE-2026-5724, ghsa-q98v-9f9w-f49q, ghsa-hmhp-gh8m-c8xp, ghsa-p2gr-hm8g-q772, ghsa-xpg8-3hhp-p7w8...

CLEANSTART-2026-WY74972 Security fixes in temporal-server 1.31.1-r3

Package temporal-server version 1.31.1-r3 fixes 8 vulnerabilities: ghsa-q98v-9f9w-f49q, ghsa-hmhp-gh8m-c8xp, ghsa-p2gr-hm8g-q772, ghsa-xpg8-3hhp-p7w8, CVE-2025-14987...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

EUVD-2026-56924

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

Temporal UI Server may set OAuth credential cookies without Secure when TLS terminates at a reverse proxy and forwards callbacks to the UI server over HTTP. This can allow an attacker-controlled scenario to access access-token and possibly refresh-token cookies if the attacker can steer UI hostna...

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-11931 Malicious code in @servicetitan/temporal-lite (npm)

npm/@servicetitan/temporal-lite is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/temporal-lite (npm)

npm/@servicetitan/temporal-lite is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

SUSE CVE-2026-5199

A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess specific victim workflow IDs and, for signal operations, signal names. This was due to a bu...