CLEANSTART-2026-CQ39979 Security fixes in cassandra 5.0.6-r2

Package cassandra version 5.0.6-r2 fixes 26 vulnerabilities: ghsa-72hv-8253-57qq, ghsa-pr98-23f8-jwxv, ghsa-25qh-j22f-pwp8, ghsa-6v67-2wr5-gvf4, ghsa-qqpg-mvqg-649v...

CLEANSTART-2026-IW13101 Security fixes in cassandra-reaper-fips 3.7.1-r4

Package cassandra-reaper-fips version 3.7.1-r4 fixes 42 vulnerabilities: CVE-2022-1471, CVE-2022-38752, CVE-2022-41854, CVE-2025-52999, ghsa-72hv-8253-57qq...

GHSA-3G8R-4PFX-JMFH vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

CVE-2026-59920 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

CVE-2026-59920 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

GHSA-3G8R-4PFX-JMFH vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

CVE-2026-59901 vulnerabilities

Vulnerabilities for packages: zookeeper, cassandra, infinispan, flyway, apache-pulsar, akhq, neo4j, thingsboard, wavefront-proxy, cloudwatch-exporter, apache-activemq-artemis, cassandra-reaper, strimzi-kafka-operator, apicurio-registry, apache-nifi, management-api-for-apache-cassandra-5.0, tez,...

GHSA-558V-64GR-WGG4 vulnerabilities

Vulnerabilities for packages: zookeeper, cassandra, infinispan, flyway, apache-pulsar, akhq, neo4j, thingsboard, wavefront-proxy, cloudwatch-exporter, apache-activemq-artemis, cassandra-reaper, strimzi-kafka-operator, apicurio-registry, apache-nifi, management-api-for-apache-cassandra-5.0, tez,...

PYSEC-2026-2897 PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. Details This issue affec...

CVE-2026-60090

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store createcollection backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value declared as int but not enforced at runtime is...

EUVD-2026-43175

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store createcollection backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value declared as int but not enforced at runtime is...

CVE-2026-60090 PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store createcollection backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value declared as int but not enforced at runtime is...

CVE-2026-60090 PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store createcollection backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value declared as int but not enforced at runtime is...

GHSA-JHQ6-GFMJ-V8FX vulnerabilities

Vulnerabilities for packages: airbyte-server, kafbat-ui, dependency-track-apiserver, cassandra-reaper, localstack, sonar-scanner-cli, management-api-for-apache-cassandra-5.0, kafbat-ui-fips, airbyte-server-fips, thingsboard, cassandra-fips, management-api-for-apache-cassandra-4.0,...

CVE-2026-10532 vulnerabilities

Vulnerabilities for packages: airbyte-server, kafbat-ui, dependency-track-apiserver, cassandra-reaper, localstack, sonar-scanner-cli, management-api-for-apache-cassandra-5.0, kafbat-ui-fips, airbyte-server-fips, thingsboard, cassandra-fips, management-api-for-apache-cassandra-4.0,...

CVE-2026-10532 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, cassandra, keycloak-config-cli, apache-nifi-registry, akhq, trino, sonar-scanner-cli, thingsboard, cassandra-reaper, nextflow, apache-nifi, management-api-for-apache-cassandra-5.0, zookeeper...

GHSA-JHQ6-GFMJ-V8FX vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, cassandra, keycloak-config-cli, apache-nifi-registry, akhq, trino, sonar-scanner-cli, thingsboard, cassandra-reaper, nextflow, apache-nifi, management-api-for-apache-cassandra-5.0, zookeeper...

PYSEC-2026-1053 Openstack DBaaS (Trove) Improper Link Resolution Before File Access

The writeconfig function in trove/guestagent/datastore/experimental/mongodb/service.py, resetconfiguration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, writeconfig function in trove/guestagent/datastore/experimental/redis/service.py, writemycnf function in...

GO-2026-5467 Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation in github.com/authorizerdev/authorizer

Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation in github.com/authorizerdev/authorizer...

CVE-2026-47846

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRAUSER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassand...