ROOT-OS-ALPINE-324-CVE-2026-22770 CVE-2026-22770 in imagemagick - Patched by Root

Root has patched CVE-2026-22770 in the imagemagick package for Root:Alpine:3.24. Multiple fixed versions available...

ROOT-OS-ALPINE-324-CVE-2026-56379 CVE-2026-56379 in imagemagick - Patched by Root

Root has patched CVE-2026-56379 in the imagemagick package for Root:Alpine:3.24. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-6846 CVE-2026-6846 in binutils - Patched by Root

Root has patched CVE-2026-6846 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-3441 CVE-2026-3441 in binutils - Patched by Root

Root has patched CVE-2026-3441 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-3442 CVE-2026-3442 in binutils - Patched by Root

Root has patched CVE-2026-3442 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2025-69649 CVE-2025-69649 in binutils - Patched by Root

Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2025-69650 CVE-2025-69650 in binutils - Patched by Root

Root has patched CVE-2025-69650 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...

CVE-2026-91765: Uncontrolled Recursion

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

CVE-2026-91766: Exposure of Sensitive Information to an Unauthorized Actor

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...

CVE-2026-91769: Improper Validation of Certificate with Host Mismatch

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-91768: Incomplete Comparison with Missing Factors

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CVE-2026-93682: Out-of-bounds Read

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

CVE-2026-6103: Integer Overflow or Wraparound

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

CVE-2026-91767: Heap-based Buffer Overflow

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

CVE-2026-92842: Heap-based Buffer Overflow

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

Podroid v1.2.9

Podroid Run Linux containers and a full Linux desktop on your Android phone. No root. A real Alpine Linux VM with its own kernel - not a chroot or proot trick - so Podman, Docker and LXC behave exactly like they do on a server. Website · Documentation · Download APK Home | Running | !Built-in...

OESA-2026-3891 exiv2 security update

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fixes: Exiv2 has an out-of-bounds read...

OESA-2026-3890 exiv2 security update

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fixes: Exiv2 has an out-of-bounds read...

OESA-2026-3889 exiv2 security update

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fixes: Exiv2 has an out-of-bounds read...

CLEANSTART-2026-FW04887 Security fix for CVE-2026-34986 applied in: argo-cd 3.0.23-r2, argo-cd 3.2.7-r2, argo-cd 3.3.5-r0, argo-cd-fips 3.1.14-r0, argo-cd-fips 3.2.9-r0, argo-workflows 4.0.4-r0, boring-registry 0.17.0-r0, boring-registry-fips 0.17.0-r0, cert-manager 1.17.4-r0, cert-manager 1.18.6-r0, cert-manager 1.19.2-r2, cert-manager 1.20.0-r0, cert-manager 1.20.1-r1, cert-manager-fips 1.17.4-r1, cert-manager-fips 1.19.4-r0, cloudprober 0.13.9-r0, cloudprober 0.14.2-r0, cloudprober-fips 0.13.9-r0, cloudprober-fips 0.14.2-r0, consul-fips 1.22.2-r2, cortex 1.20.1-r1, cortex 1.21.1-r4, cosign 2.4.3-r0, cosign 2.5.3-r0, dex 2.42.1-r6, dex 2.43.1-r3, dex 2.44.0-r1, dex 2.45.1-r1, external-secrets 2.2.0-r0, external-secrets-fips 0.17.0-r2, external-secrets-fips 2.2.0-r0, flux-kustomize-controller-fips 1.8.5-r0, forecastle 1.0.159-r1, fulcio 1.5.1-r0, fulcio-fips 1.5.1-r2, fulcio-fips 1.6.6-r2, fulcio-fips 1.7.1-r1, gitlab-runner 18.11.1-r0, gomplate 4.3.3-r0, grafana-alloy 1.13.1-r1, grafana-alloy 1.14.2-r1, grafana-alloy 1.15.0-r0, grafana-alloy-fips 1.14.2.r0, grafana-alloy-fips 1.15.0-r0, grafana-alloy-fips 1.16.0-r0, grafana-mimir-fips 3.0.4-r1, grafana-mimir-fips 3.0.5-r0, helm-operator-fips 1.41.1-r2, istio 1.27.9-r0, istio 1.28.5-r3, istio 1.29.1-r1, istio-fips 1.25.5-r5, istio-fips 1.26.8-r2, istio-fips 1.27.8-r3, istio-fips 1.27.9-r0, istio-fips 1.28.5-r3, istio-fips 1.29.1-r2, istio-pilot-discovery 1.28.3-r1, istio-pilot-discovery-fips 1.28.3-r1, jitsucom-bulker 2.10.0-r0, jitsucom-bulker 2.8.6-r0, jitsucom-bulker 2.9.0-r0, keda 2.17.2-r2, keda 2.19.0-r2, keda-fips 2.18.3-r3, kserve 0.16.0-r2, kube-rbac-proxy 0.20.2-r1, kube-rbac-proxy-fips 0.20.2-r1, kyverno-fips 1.13.6-r10, kyverno-fips 1.16.3-r5, kyverno-fips 1.17.1-r4, kyverno-policy-reporter-fips 3.3.3-r5, kyverno-policy-reporter-fips 3.4.2-r5, kyverno-policy-reporter-fips 3.5.0-r5, kyverno-policy-reporter-fips 3.7.3-r1, litestream 0.5.14-r2, loki 3.6.10-r0, melange 0.45.4-r0, melange 0.46.1-r0, melange 0.47.0-r0, melange 0.48.1-r0, openbao-fips 2.1.1-r9, openbao-fips 2.2.2-r7, openbao-fips 2.4.4-r5, openbao-fips 2.5.1-r1, openbao-fips 2.5.2-r0, opentelemetry-collector-contrib 0.149.0-r0, opentelemetry-collector-contrib 0.150.0-r0, opentofu-fips 1.10.9-r5, opentofu-fips 1.11.5-r4, opentofu-fips 1.11.6-r0, opentofu-fips 1.7.10-r4, opentofu-fips 1.8.11-r4, opentofu-fips 1.9.4-r4, policy-controller 0.15.1-r0, policy-controller-fips 0.15.1-r0, prometheus-mongodb-exporter 0.47.2-r1, prometheus-mongodb-exporter-fips 0.47.2-r1, rabbitmq-messaging-topology-operator 1.16.0-r0, rabbitmq-messaging-topology-operator 1.19.1-r0, rekor-fips 1.5.1-r0, restic 0.18.0-r0, restic-fips 0.18.1-r4, rundeck 6.0.0-r0, spire-server 1.13.5-r0, spire-server 1.14.5-r0, spire-server-fips 1.14.5-r0, step 0.29.0-r0, step 0.30.2-r2, step-ca 0.27.5-r0, step-cli 0.27.5-r1, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, syft 1.42.4-r0, tekton-pipelines 1.10.2-r0, tekton-pipelines 1.11.0-r0, tekton-pipelines 1.7.0-r0, tekton-pipelines 1.9.2-r0, tekton-pipelines-fips 1.10.2-r0, tekton-pipelines-fips 1.11.0-r0, tekton-pipelines-fips 1.7.0-r0, tekton-pipelines-fips 1.9.2-r0, tempo 2.10.3-r0, tempo 2.8.3-r1, tempo 2.9.1-r0, tempo-fips 2.10.3-r0, tempo-fips 2.8.3-r1, tempo-fips 2.9.1-r1, temporal 1.5.1-r0, temporal-server 1.29.6-r0, temporal-server 1.30.4-r0, temporal-server 1.31.0.153.3-r0, temporal-server-fips 1.29.6-r0, temporal-server-fips 1.31.0.153.1-r0, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.97.2-r3, terragrunt-fips 0.98.0-r3, terragrunt-fips 0.99.5-r0, tkn 0.42.2-r1, tkn-fips 0.44.2-r0, trillian 1.7.3-r1, vault 1.20.4-r1, vault 1.21.4-r1, vault-csi-provider 1.7.0-r0, velero 1.17.2-r2, velero-fips 1.17.2-r4, velero-plugin-for-gcp-fips 1.13.2-r0, velero-plugin-for-gcp-fips 1.13.2-r2, weaviate 1.36.9-r0

CVE-2026-34986 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...