Addon

ClearURLs ClearURLs is an add-on based on the new WebExtensions technology and is optimized for Firefox and some Chrome based browsers. This extension will automatically remove tracking elements from URLs to help protect your privacy when browsing the Internet, which is regularly updated by us an...

CLEANSTART-2026-TN95778 In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found

Security vulnerability affects the kedacore-http-add-on package. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found...

CLEANSTART-2026-WT34368 When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n

Security vulnerability affects the kedacore-http-add-on package. When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n...

community-scripts

Community Scripts A collection of ZAP scripts provided by the community, i.e. you lot : The easiest way to use this repo in ZAP is to install the 'Community Scripts' add-on from the ZAP Marketplace. !CAUTION While we do review all scripts to ensure they don't do anything obviously malicious, you...

CLEANSTART-2024-ZR04755 When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator

CVE-2020-12421 affects multiple packages. When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected even if they were legitimately added by an administrator. See references for individual vulnerability details...

CLEANSTART-2024-VZ22734 When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox wo...

Security vulnerability affects the librewolf package. When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed...

CLEANSTART-2024-SC60568 When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator

CVE-2020-12421 affects multiple packages. When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected even if they were legitimately added by an administrator. See references for individual vulnerability details...

CLEANSTART-2026-MU97510 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the kedacore-http-add-on package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-HO29942 Security fix for GHSA-gcjh-h69q-9w9g applied in: kedacore-http-add-on 0.14.0-r2, kedacore-http-add-on 0.13.0-r2

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2024-TW25811 When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox wo...

CVE-2022-26387 affects multiple packages. When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. See references for individual...

CLEANSTART-2026-CD71740 KEDA is a Kubernetes-based Event Driven Autoscaling component

Security vulnerability affects the kedacore-http-add-on package. KEDA is a Kubernetes-based Event Driven Autoscaling component...

CLEANSTART-2026-PE79543 KEDA is a Kubernetes-based Event Driven Autoscaling component

Security vulnerability affects the kedacore-http-add-on package. KEDA is a Kubernetes-based Event Driven Autoscaling component...

Important: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...

CVE-2026-59177 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

GO-2026-6776 vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent, kserve, keda-http-add-on-fips, kserve-localmodelnode-agent-fips, kserve-fips, keda-http-add-on, k8sgpt...

CVE-2026-94018

The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a Content-Length underflow while processing a PUT request. The condition is reachable by an unauthenticated remote client with a single malformed request...

CVE-2026-93003

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...