CLEANSTART-2026-XJ05630 Security fixes in kubewatch 2.12.0-r0

Package kubewatch version 2.12.0-r0 fixes 1 vulnerabilities: ghsa-gxhx-2686-5h9g...

CLEANSTART-2026-LR60096 Security fixes in dex-fips 2.40.0-r3

Package dex-fips version 2.40.0-r3 fixes 1 vulnerabilities: CVE-2025-47907...

CLEANSTART-2026-KH99344 Security fixes in jitsucom-jitsu 2.11.0-r0

Package jitsucom-jitsu version 2.11.0-r0 fixes 9 vulnerabilities: ghsa-mwv6-3258-q52c, ghsa-w37m-7fhw-fmv9, CVE-2025-30218, CVE-2025-49005, CVE-2025-65945...

CLEANSTART-2026-RB40964 Security fixes in ip-masq-agent 2.9.3-r0

Package ip-masq-agent version 2.9.3-r0 fixes 2 vulnerabilities: ghsa-6wxm-mpqj-6jpf, CVE-2024-45339...

CLEANSTART-2026-VJ80514 Security fixes in harbor-fips 2.11.2-r5

Package harbor-fips version 2.11.2-r5 fixes 4 vulnerabilities: CVE-2025-30223, CVE-2024-55885, CVE-2025-27144, CVE-2025-54410...

CLEANSTART-2026-EP15881 Security fixes in cert-manager-webhook-pdns-fips 2.3.0-r0

Package cert-manager-webhook-pdns-fips version 2.3.0-r0 fixes 17 vulnerabilities: CVE-2022-1996, CVE-2023-45142, CVE-2023-25151, CVE-2022-21698, CVE-2022-30636...

CLEANSTART-2026-JB37020 Security fixes in harbor 2.14.3-r0

Package harbor version 2.14.3-r0 fixes 7 vulnerabilities: CVE-2025-68121, CVE-2021-3538, CVE-2026-27139, CVE-2025-29923, CVE-2026-27142...

CLEANSTART-2026-FM34446 Security fixes in kubernetes-csi-node-driver-registrar 2.13.0-r0

Package kubernetes-csi-node-driver-registrar version 2.13.0-r0 fixes 59 vulnerabilities: CVE-2024-45336, CVE-2024-45341, CVE-2025-0913, CVE-2025-22866, CVE-2025-22870...

CVE-2026-13330

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...

PT-2026-66448

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

CVE-2026-35847

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

EUVD-2026-51328

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

PT-2026-66590

Name of the Vulnerable Software and Affected Versions dnsmgr versions prior to 2.16 Description A local attacker can execute arbitrary code through the ping function located in the CheckUils.php file. Recommendations Update dnsmgr to version 2.16 or later. As a temporary workaround, restrict acce...

PT-2026-66445

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

PT-2026-66514

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description The software is susceptible to JSON Hijacking, a technique where an attacker steals sensitive data from a JSON response. This flaw subsequently leads to Cross-Site Request Forgery CSRF, which...

CVE-2026-67428

The CVE-2026-67428 entry concerns Flyto2 Core, an automation/AI-agent workflow kernel. Before version 2.26.7, multiple HTTP-emitting modules (including http/requests.py, core.api.http_get, core.api.http_post, graphql.query/mutation, monitor.http_check, communication.slack_send, notification.disco...

CVE-2026-67427

CVE-2026-67427 , affecting Flyto2 Core prior to 2.26.6, enables the workflow engine’s variable resolver to expand ${env.VAR} for any host environment variable without an allowlist or policy check. This bypasses the default capability policy denylist for env.get and env.load_dotenv, enabling a wor...

io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message

A flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service DoS due to memory exhaustion...