GHSA-2PF9-VR92-6H3V vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...

GHSA-9H3P-52VH-959W vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...

GHSA-JX8C-56MG-H6VP vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...

CVE-2026-24514 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...

GHSA-4G2F-XCPH-2335 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...

CVE-2026-24513 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...

CVE-2026-1580 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...

EUVD-2026-41372

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2capsockcleanuplisten vs l2capconndel btacceptdequeue unlinks a not-yet-accepted child from the parent accept queue and releasesocks it before returning, so the returned sk has no caller reference and is...

CVE-2026-53357 Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2capsockcleanuplisten vs l2capconndel btacceptdequeue unlinks a not-yet-accepted child from the parent accept queue and releasesocks it before returning, so the returned sk has no caller reference and is...

CVE-2026-53357

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2capsockcleanuplisten vs l2capconndel btacceptdequeue unlinks a not-yet-accepted child from the parent accept queue and releasesocks it before returning, so the returned sk has no caller reference and is...

PT-2026-55374

Summary AssetsController::actionDeleteFolder only requires the deleteAssets: permission for the target folder. It never enforces deletePeerAssets:, even though Assets::deleteFoldersByIds cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A...

PT-2026-55234

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth L2CAP socket cleanup process. The problem occurs during a race condition between l2cap sock cleanup listen and l2cap conn del. Specifically...

CVE-2026-50284 Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

Craft CMS is a content management system CMS. In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder only requires the deleteAssets: permission for the target folder. It never enforces deletePeerAssets:, even though Assets::deleteFoldersByIds...

CVE-2026-49478 vulnerabilities

Vulnerabilities for packages: gitsign, kots, kubescape, flux-source-controller, skopeo, falcoctl, buildah, ratify, witness, zarf, podman, undock, tekton-chains, aactl, slsa-verifier, falco-no-driver, kyverno-notation-aws, kyverno...

GHSA-F5MR-Q85P-6HH6 vulnerabilities

Vulnerabilities for packages: gitsign, kots, kubescape, flux-source-controller, skopeo, falcoctl, buildah, ratify, witness, zarf, podman, undock, tekton-chains, aactl, slsa-verifier, falco-no-driver, kyverno-notation-aws, kyverno...

CVE-2026-49835 vulnerabilities

Vulnerabilities for packages: tkn, gitsign, kubescape, tflint, policy-controller, falcoctl, ratify, crossplane, trivy-operator, spire-server, goreleaser, trivy, tekton-chains, aactl, zarf, neuvector-sigstore-interface, kyverno-notation-aws, kyverno...

GHSA-9C54-X2G4-V92J vulnerabilities

Vulnerabilities for packages: tkn, gitsign, kubescape, tflint, policy-controller, falcoctl, ratify, crossplane, trivy-operator, spire-server, goreleaser, trivy, tekton-chains, aactl, zarf, neuvector-sigstore-interface, kyverno-notation-aws, kyverno...

CVE-2026-53332

A flaw was found in the Linux kernel's Qualcomm NGD Next Generation Display controller qcom-ngd-ctrl component. This vulnerability arises from a race condition where callbacks are registered before the NGD device is fully initialized. This can lead to the callbacks operating on uninitialized data...

foreman: Foreman: Information disclosure via improper validation of nested request parameters

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...

CVE-2026-49478 vulnerabilities

Vulnerabilities for packages: slsa-verifier, kubescape-server-fips, podman-fips, ratify, skopeo-fips, portieris-fips, undock, podman, zarf, zarf-fips, chainctl, prometheus-podman-exporter, buildah-fips, kyverno-notation-aws, prometheus-podman-exporter-fips, kubescape, tekton-chains-fips,...