CVE-2026-45404 vulnerabilities

Vulnerabilities for packages: cortex, cortex-geomys-fips, tempo-fips, pulumi-language-yaml, thanos, thanos-fips, cortex-fips...

GHSA-42CJ-99W8-CP2P vulnerabilities

Vulnerabilities for packages: cortex, cortex-geomys-fips, tempo-fips, pulumi-language-yaml, thanos, thanos-fips, cortex-fips...

CVE-2026-49986

The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...

CVE-2026-49986

Summary: CVE-2026-49986 describes a local arbitrary code execution in the Cortex MCP server (neuro-cortex-memory) prior to version 3.17.1. The root cause is permissive validation in _find_dev_source()/ _is_cortex_root(): the code trusts the CLAUDE_PROJECT_DIR environment variable (set by Claude C...

CVE-2026-49986 Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...

CVE-2026-49986 Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

The Cortex MCP server neuro-cortex-memory, a cross-platform persistent memory MCP, prior to version 3.17.1 treats the CLAUDEPROJECTDIR environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the openvisualizati...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: rekor, cortex, argo-cd, grafana-mimir, timestamp-authority, rekor-fips, prometheus-alertmanager-fips, prometheus-alertmanager, timestamp-authority-fips, cortex-fips, fulcio, fulcio-fips...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: grafana-mimir, rekor, fulcio, prometheus-alertmanager, timestamp-authority, cortex...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: airflow, rekor, secrets-store-csi-driver-provider-azure, bank-vaults, tempo, pulumi, goreleaser, guac, sigstore-scaffolding, velero, ksops, argo-workflows, zarf, k8sgpt, chezmoi, cortex, argo-events, fluent-bit-plugin-loki, policy-controller,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: net-kourier, kube-logging-operator-custom-runner, k9s, kbld, cilium, vertical-pod-autoscaler, pgpool2exporter, crossplane, crossplane-provider-aws-cloudformation, kiali, percona-server-mongodb-operator, kots, goreleaser, litestream, kubernetes-csi-external-snapshotte...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, kube-logging-operator-custom-runner, terraform-provider-time, kbld, falcosidekick, rabbitmq-messaging-topology-operator, tfsec, vertical-pod-autoscaler, ferretdb, newrelic-fluent-bit-output, pgpool2exporter,...

CLEANSTART-2026-LV48366 Security fixes in cortex 1.19.1-r0

Package cortex version 1.19.1-r0 fixes 4 vulnerabilities: CVE-2026-33186, CVE-2026-39822, CVE-2026-42505, CVE-2026-56852...

CLEANSTART-2026-XG50773 Security fixes in cortex 1.20.1-r0

Package cortex version 1.20.1-r0 fixes 5 vulnerabilities: CVE-2025-69725, CVE-2026-2303, CVE-2026-29181, CVE-2026-24051, CVE-2026-39883...

CLEANSTART-2026-ZL34069 Security fixes in cortex 1.20.1-r2

Package cortex version 1.20.1-r2 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-YD94127 Security fixes in cortex 1.20.1-r1

Package cortex version 1.20.1-r1 fixes 5 vulnerabilities: CVE-2026-34986, CVE-2026-33186, CVE-2026-39822, CVE-2026-42505, CVE-2026-56852...

CLEANSTART-2026-MK94293 Security fixes in cortex 1.19.1-r1

Package cortex version 1.19.1-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-RM95899 Security fixes in cortex 1.18.1-r4

Package cortex version 1.18.1-r4 fixes 3 vulnerabilities: ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw, CVE-2026-41178...

CVE-2026-11985

On the Zephyr ARM port, enabling the hardware FPU CONFIGFPU forces the "Floating point ABI" choice, which defaults to CONFIGFPHARDABI. Both FPHARDABI and FPSOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the...

CVE-2026-11985 Cross-thread FPU register leak on ARM when FPU enabled without register sharing

On the Zephyr ARM port, enabling the hardware FPU CONFIGFPU forces the "Floating point ABI" choice, which defaults to CONFIGFPHARDABI. Both FPHARDABI and FPSOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the...

CVE-2026-68330 net: airoha: Fix DMA direction for NPU mailbox buffer

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...