GHSA-3P68-RC4W-QGX5 vulnerabilities

Vulnerabilities for packages: prism, opensearch-dashboards, lerna, kubeflow-pipelines, jitsucom-jitsu, kubeflow-centraldashboard, nextcloud-server, kubeflow-katib, langfuse, saf...

golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

GHSA-3P68-RC4W-QGX5 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kibana, prism, lerna, kubeflow-katib, jitsucom-jitsu, langfuse-fips, awx, nextcloud-server, kubeflow-centraldashboard, gitlab-rails-ce, wazuh-dashboard, langfuse, saf, opensearch-dashboards-fips, opensearch-dashboards, gitlab-rails-ce-fips,...

CVE-2026-5500

wolfSSL's wcPKCS7DecodeAuthEnvelopedData does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸...

GHSA-3MWP-WVH9-7528 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9...

GHSA-43RW-359F-4H89 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-39859 vulnerabilities

Vulnerabilities for packages: kibana...

GHSA-MJMQ-GWGM-5QHM vulnerabilities

Vulnerabilities for packages: hadoop-fips...

GHSA-JR6H-R7VG-F9MC vulnerabilities

Vulnerabilities for packages: druid...

GHSA-5MF9-H53Q-7MHQ vulnerabilities

Vulnerabilities for packages: authentik, awx, authentik-fips, label-studio...

CVE-2026-33034 vulnerabilities

Vulnerabilities for packages: authentik, awx, authentik-fips, label-studio...

ROS-20260410-73-0009

Vulnerability in libssh related to incorrect external control of file name or path. Exploitation of the vulnerability could allow an attacker to escalate privileges...

ROS-20260410-73-0016

Vulnerability in curl related to authentication bypass due to an initial bug. Exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges...

ROS-20260410-73-0017

Vulnerability in expat related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

ROS-20260410-73-0004

A vulnerability in the Node.js software platform involves an incorrect restriction of the path name of a restricted directory. Exploitation of the vulnerability could allow an attacker to compromise the system...

SUSE CVE-2026-5918

Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-21713 affecting package nodejs for versions less than 20.14.0-15

CVE-2026-21713 affecting package nodejs for versions less than 20.14.0-15. A patched version of the package is available...

CVE-2026-5264

Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow...

GHSA-W8RR-5GCM-PP58 vulnerabilities

Vulnerabilities for packages: kots, cerbos, opentelemetry-collector-contrib, gitlab-kas, opa, spicedb, terragrunt, bento, op-geth, dgraph, tempo, docker-compose, terraform-mcp-server, flux-notification-controller, hubble, octo-sts, cilium, external-secrets-operator, splunk-otel-collector,...

CVE-2026-5439

A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and trusts metadata fields describing the uncompressed size of archived files. An attacker can craft a small ZIP archive containing a forged size value,...