CVE-2026-90452 Improper certificate validation in Malcolm

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-90452 Improper certificate validation in Malcolm

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-90452 Improper certificate validation in Malcolm

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-89720

A flaw was found in the Linux kernel's Unsorted Block Image File System UBIFS. An incorrect bounds check in the ubifssbverifysignature function allows a crafted signed UBIFS image to declare a signature length larger than its actual size. This can lead to an out-of-bounds read when processing the...

CVE-2026-54248

Doco-CD , a GitOps continuous delivery tool for Docker Compose projects and Swarm stacks, contains an OCI trust-policy bypass prior to version 0.90.1 . A trust-boundary flaw allowed artifact-provided .doco-cd.yml configuration (with oci.verify: false) to override the global OCI_TRUST_POLICY, caus...

EUVD-2026-76757

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-54248 Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-89697

A flaw was found in the Linux kernel's Network File System Daemon nfsd. When setting file attributes using nfsdprocsetattr, a specific code path BOTHTIMESET branch prematurely verifies file handles. This bypasses a critical write verification step fhwantwrite, allowing file attribute changes to...

CVE-2026-54174

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

EUVD-2026-76767

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174

CVE-2026-54174 affects melange (Chainguard's declarative APK package builder), specifically the Apko component (chainguard.dev/apko). Prior to Apko 1.2.9 (corresponding to melange 0.50.4), the tool verified the control section hash (.PKGINFO etc.) against the signed APKINDEX but never verified th...

GHSA-VJFW-CPMH-XWV3 Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the knownhosts and /.ssh/config fallbacks, and a repo-wide searc...

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Vulnerability Central Dogma's Git mirror SSH client installs an Apache MINA SSHD ServerKeyVerifier lambda that returns true unconditionally for every outbound SSH connection used by git+ssh:// mirrors. The accompanying lines disable the knownhosts and /.ssh/config fallbacks, and a repo-wide searc...

CVE-2026-49464 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

CVE-2026-89770

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

DEBIAN-CVE-2026-89770

In the Linux kernel, the following vulnerability has been resolved: iomap: don't free integrity payload that doesn't exist fsbiointegrityalloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fsbiointegrityfree in...

CVE-2026-89720

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature bounds the on-disk ubifssignode-len field before handing the signature payload to verifypkcs7signature, but the check has the wrong sign: if...