CLEANSTART-2026-SW69995 Security fixes in opentelemetry-collector-contrib 0.150.0-r0

Package opentelemetry-collector-contrib version 0.150.0-r0 fixes 8 vulnerabilities: CVE-2026-46595, CVE-2026-33816, CVE-2026-39821, CVE-2026-41602, CVE-2026-34986...

CLEANSTART-2026-SL88227 Security fixes in opentelemetry-collector-contrib-fips 0.144.0-r3

Package opentelemetry-collector-contrib-fips version 0.144.0-r3 fixes 8 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-33186, CVE-2020-8912...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector-contrib: opentelemetry-collector-contrib-0.157.0-0.1.hum1 aarch64, x8664 opentelemetry-collector-contrib-0.157.0-0.1.hum1.src src...

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting XSS...

CLEANSTART-2026-MA24172 Security fixes for CVE-2026-2303, CVE-2026-27145, CVE-2026-33816, CVE-2026-34986, CVE-2026-39821, CVE-2026-39822, CVE-2026-39824, CVE-2026-39883, CVE-2026-41602, CVE-2026-42504, CVE-2026-42505, CVE-2026-42507, CVE-2026-46595, CVE-2026-48496, ghsa-6g7g-w4f8-9c9x, ghsa-mpwr-8vm7-h73f, ghsa-p77j-4mvh-x3m3, ghsa-xmrv-pmrh-hhx2 applied in versions: 0.144.0-r3, 0.144.0-r4, 0.150.0-r0, 0.150.0-r1, 0.152.0-r0

Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. These issues are resolved in later releases. See references for individual vulnerability details...

EUVD-2026-44852

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

DEBIAN-CVE-2026-38974

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

CVE-2026-38974

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

CVE-2026-38974

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

PT-2026-60333

Name of the Vulnerable Software and Affected Versions Dulwich versions prior to 1.1.0 Description Dulwich fails to perform SSH host key verification within the contrib/paramiko vendor.py file. This lack of verification allows for potential man-in-the-middle attacks during SSH connections...

CVE-2026-38974

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

CVE-2026-38974

CVE-2026-38974 affects Dulwich up to 1.1.0, where the SSH host key verification is missing in contrib/paramiko_vendor.py. The flaw enables a remote attacker to impersonate a legitimate Git server during SSH connections, potentially exposing sensitive data or enabling code execution on the client....

CLEANSTART-2026-AV21509 Security fixes for CVE-2026-27145, CVE-2026-33816, CVE-2026-34986, CVE-2026-39821, CVE-2026-39824, CVE-2026-39883, CVE-2026-41602, CVE-2026-42504, CVE-2026-42507, CVE-2026-46595, ghsa-6g7g-w4f8-9c9x, ghsa-p77j-4mvh-x3m3, ghsa-xmrv-pmrh-hhx2 applied in versions: 0.144.0-r3, 0.144.0-r4, 0.150.0-r0, 0.150.0-r1

Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-11915 Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions:...

CVE-2026-15087 Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions:...

CVE-2026-15086 Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077

vulnerability in Drupal Raw Formatter Meta Tag Formatter allows . This issue affects Raw Formatter Meta Tag Formatter versions:...

CVE-2026-15089

The CVE-2026-15089 entry concerns a vulnerability in Drupal Commerce guest registration. Affected component: Drupal Commerce guest registration feature; details on affected versions are not provided beyond “. ” in the documents. The CVSS 3.1 base score is listed as 9.1 (CRITICAL) with high confid...

CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

Cross-Site Request Forgery CSRF vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3...

CVE-2026-10770

The CVE-2026-10770 entry corresponds to a Reflected XSS in Drupal Anti-Spam by CleanTalk, affecting versions 0.0.0 through 9.7.1. The root cause is improper neutralization of input in the module’s HTML output, where CleanTalk API response content is echoed directly via _cleantalk_die() and ct_die...

GO-2026-5690 opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver

opentelemetry-collector-contrib: githubreceiver silently ignores configured requiredheaders authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver...