CLEANSTART-2026-MI75694 Security fixes in k8ssandra-client-fips 0.7.0-r5

Package k8ssandra-client-fips version 0.7.0-r5 fixes 11 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...

CLEANSTART-2026-ZM65056 Security fixes in k8ssandra-client-fips 0.7.0-r7

Package k8ssandra-client-fips version 0.7.0-r7 fixes 13 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-39820, CVE-2026-39819, CVE-2026-29181, CVE-2026-42499...

CLEANSTART-2026-DV38059 Security fixes in k8ssandra-client-fips 0.6.4-r6

Package k8ssandra-client-fips version 0.6.4-r6 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-WH63397 Security fixes in k8ssandra-client-fips 0.6.4-r5

Package k8ssandra-client-fips version 0.6.4-r5 fixes 5 vulnerabilities: CVE-2025-61726, CVE-2025-61730, CVE-2025-61728, CVE-2025-68119, CVE-2025-61731...

CLEANSTART-2026-UV81951 Security fixes in k8ssandra-client-fips 0.8.8-r0

Package k8ssandra-client-fips version 0.8.8-r0 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

UBUNTU-CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

EUVD-2026-50979

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-59326

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

kernel: smb: client: fix OOB reads parsing symlink error response

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote, untrusted server could send a specially crafted symlink error response, leading to an out-of-bounds read vulnerability. This could result in the disclosure of sensitive information from the kernel's memory to a loca...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

PT-2026-66461

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client id and clien...

PT-2026-66597

Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.7 Description TenantResource RawItems and Generators in internal/controllers/resources/collect.go, specifically within the handleRawItem and handleGeneratorItem functions, fail to apply the...

The vulnerability of the nfs_match_client() function in the fs/nfs/client.c module, which is part of the NFS client support in Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the nfsmatchclient function in the fs/nfs/client.c module, which is part of the NFS client support in Linux kernel, is related to authentication errors. Exploiting this vulnerability could allow an attacker to cause service failures...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2146 more potentially affected by CVE-2026-16728 via undici (>=6.0.0, <=6.27.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =2.7.0, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =1.10.0-release and more Source cves: CVE-2026-16728 Source advisory: SNYK:JS-UNDICI-18426063...