CLEANSTART-2026-FM34446 Security fixes in kubernetes-csi-node-driver-registrar 2.13.0-r0

Package kubernetes-csi-node-driver-registrar version 2.13.0-r0 fixes 59 vulnerabilities: CVE-2024-45336, CVE-2024-45341, CVE-2025-0913, CVE-2025-22866, CVE-2025-22870...

CLEANSTART-2026-ZJ55365 Security fixes in ip-masq-agent 2.12.6-r1

Package ip-masq-agent version 2.12.6-r1 fixes 24 vulnerabilities: CVE-2025-61726, CVE-2026-25679, CVE-2025-61729, CVE-2025-68121, CVE-2025-68119...

CLEANSTART-2026-JB37020 Security fixes in harbor 2.14.3-r0

Package harbor version 2.14.3-r0 fixes 7 vulnerabilities: CVE-2025-68121, CVE-2021-3538, CVE-2026-27139, CVE-2025-29923, CVE-2026-27142...

CLEANSTART-2026-YF59488 Security fixes in external-secrets 2.3.0-r1

Package external-secrets version 2.3.0-r1 fixes 7 vulnerabilities: CVE-2026-32952, CVE-2026-29181, CVE-2026-2303, ghsa-pjcq-xvwq-hhpj, ghsa-mh2q-q3fh-2475...

CLEANSTART-2026-WI97391 Security fixes in opensearch-k8s-operator-fips 2.7.0-r8

Package opensearch-k8s-operator-fips version 2.7.0-r8 fixes 23 vulnerabilities: CVE-2026-25679, CVE-2025-61726, CVE-2025-61725, CVE-2025-61723, CVE-2026-27142...

CLEANSTART-2026-KZ64972 Security fixes in openbao-fips 2.5.0-r1

Package openbao-fips version 2.5.0-r1 fixes 3 vulnerabilities: CVE-2026-24051, CVE-2026-26958, CVE-2026-1229...

CLEANSTART-2026-RF73854 Security fixes in keda 2.18.3-r0

Package keda version 2.18.3-r0 fixes 6 vulnerabilities: CVE-2026-26958, CVE-2025-68156, CVE-2026-24051, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr...

CVE-2026-13330

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...

PT-2026-66448

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

PT-2026-66445

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

PT-2026-66514

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description The software is susceptible to JSON Hijacking, a technique where an attacker steals sensitive data from a JSON response. This flaw subsequently leads to Cross-Site Request Forgery CSRF, which...

CVE-2026-35847

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

EUVD-2026-51328

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

PT-2026-66590

Name of the Vulnerable Software and Affected Versions dnsmgr versions prior to 2.16 Description A local attacker can execute arbitrary code through the ping function located in the CheckUils.php file. Recommendations Update dnsmgr to version 2.16 or later. As a temporary workaround, restrict acce...

CVE-2026-67428

The CVE-2026-67428 entry concerns Flyto2 Core, an automation/AI-agent workflow kernel. Before version 2.26.7, multiple HTTP-emitting modules (including http/requests.py, core.api.http_get, core.api.http_post, graphql.query/mutation, monitor.http_check, communication.slack_send, notification.disco...

CVE-2026-67427

CVE-2026-67427 , affecting Flyto2 Core prior to 2.26.6, enables the workflow engine’s variable resolver to expand ${env.VAR} for any host environment variable without an allowlist or policy check. This bypasses the default capability policy denylist for env.get and env.load_dotenv, enabling a wor...

io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message

A flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service DoS due to memory exhaustion...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.6 security update

Red Hat multicluster engine for Kubernetes v2.9 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score...