CVE-2025-38499 affecting package kernel for versions less than 5.15.200.1-1

CVE-2025-38499 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...

GHSA-XXH7-FCF3-RJ7F vulnerabilities

Vulnerabilities for packages: confluent-kafka, strimzi-kafka-operator, apache-pulsar, dependency-track, akhq, trino, solr, druid, kafka...

CVE-2026-1605 vulnerabilities

Vulnerabilities for packages: confluent-kafka, strimzi-kafka-operator, apache-pulsar, dependency-track, akhq, trino, solr, druid, kafka...

CVE-2026-29786

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Th...

GHSA-V5RP-3MCX-FR73 vulnerabilities

Vulnerabilities for packages: libvips...

ROS-20260304-73-0025

A vulnerability in the Linux operating system kernel is related to a pointer dereferencing bug. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

firefox: thunderbird: Invalid pointer in the JavaScript Engine component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript Engine component...

cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...

cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...

GHSA-XH87-MX6M-69F3 vulnerabilities

Vulnerabilities for packages: kibana...

CVE-2026-28418

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundar...

GHSA-9F29-V6MM-PW6W vulnerabilities

Vulnerabilities for packages: opa-envoy...

GHSA-WH2J-26J7-9728 vulnerabilities

Vulnerabilities for packages: airflow...

cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...

GHSA-QVHC-9V3J-5RFW vulnerabilities

Vulnerabilities for packages: dotnet...

CVE-2026-2869

A vulnerability was identified in janet-lang janet up to 1.40.1. Affected by this vulnerability is the function janetcvarset of the file src/core/specials.c of the component handleattr Handler. The manipulation leads to out-of-bounds read. The attack can only be performed from a local environment...

GHSA-69X3-G4R3-P962 vulnerabilities

Vulnerabilities for packages: step-fips, caddy-fips, step-ca-fips, step-issuer-fips, caddy, step-issuer, step, step-ca...

GHSA-FPJ8-GQ4V-P354 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-3PPC-4F35-3M26 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, code-server, opensearch-dashboards, kubeflow-katib, argo-workflows, sqlpad, tileserver-gl, rancher-api-ui, npm, vitess, ts-patch, renovate, kubeflow-centraldashboard, prism, pulumi, serve, eslint, lerna, node-gyp, py3-jupyterlab, pnpm-stage0, saf,...

GHSA-2G4F-4PWH-QVX6 vulnerabilities

Vulnerabilities for packages: eslint, drupal, langfuse-fips, gemini-cli, sqlpad, saf, kubeflow-katib, authentik, argo-workflows, kibana, opensearch-dashboards, authentik-fips, gitlab-rails-ce, kubeflow-centraldashboard, opensearch-dashboards-fips, tileserver-gl, kubeflow-pipelines,...