Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

GO-2026-6213 vulnerabilities

Vulnerabilities for packages: k9s-fips, kubescape-server-fips, cloudbeat, flux-notification-controller, gomplate-fips, witness, pulumi, act, grafana-alloy, flux-operator, src-fingerprint-fips, crossplane-fips, kots, k9s, pulumi-language-dotnet, pulumi-language-yaml, nfpm, pulumi-language-java, zo...

CVE-2026-75569 Mce-operator-bundle: mce-operator-bundle: bundle-generation business logic fetched from mutable stolostron/release@master

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-61634 vulnerabilities

Vulnerabilities for packages: zipkin, thingsboard, cassandra-reaper, druid...

CVE-2026-76226 Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

GO-2024-2653 vulnerabilities

Vulnerabilities for packages: hubble-ui, hubble-ui-backend-fips...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: rancher-fleet, rclone-fips, gitlab-rails-ce, seaweedfs-rocksdb, packer-fips, flux, terragrunt-fips, cerbos-fips, grafana, scorecard, argo-cd, terragrunt, syft, kyverno-fips, chainloop-cli, upwind-agent, gitlab-rails-ce-fips, amazon-ssm-agent, skaffold-fips,...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: k9s-fips, kubescape-server-fips, cloudbeat, gomplate-fips, witness, pulumi, chainctl-fips, zarf-fips, grafana-alloy, zarf, src-fingerprint-fips, crossplane-fips, wolfictl, kots, k9s, pulumi-language-dotnet, pulumi-language-yaml, nfpm, pulumi-language-java, zot,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: certificate-transparency, minio-object-browser, wavefront-collector-for-kubernetes, datadog-agent, keda-fips, prometheus-pushgateway-fips, cloudzero-agent-fips, beats-fips, elastic-agent-fips, prometheus, jaeger, elastic-agent, node-problem-detector,...

GO-2024-2599 vulnerabilities

Vulnerabilities for packages: ferretdb, k8sgpt, hubble-ui-backend-fips, temporal-server, velero, doppler-kubernetes-operator, go-md2man, gh, slsa-verifier, fq, nri-haproxy, dockerize-fips, kubernetes-csi-external-resizer, rabbitmq-cluster-operator, cortex, prometheus-alertmanager-fips,...

GO-2026-4945 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, terraform-provider-acme-fips, commercial-chainloop-backend, k8sgpt, chainloop-control-plane, temporal-server, vault-secrets-operator, velero, tkn, slsa-verifier, kyverno-policy-reporter-plugins-kyverno-fips, temporal-ui-server-fips, witness,...

GO-2026-5029 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-azure-storage, step, hubble, minio, nerdctl, terraform-provider-acme, k3s, prometheus-operator, step-issuer, cilium, snyk-cli, flux, gptscript, helm, kubernetes-dashboard, external-secrets-operator,...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: kubevela, kaniko, pulumi-kubernetes-operator, gitaly, gomplate, trivy, nuclei, grafana-alloy, flux-image-automation-controller, melange, scorecard, witness, zarf, chezmoi, guac, syft, flux-source-controller, snyk-cli, cerbos, flux, gptscript, trufflehog,...

GO-2024-3305 vulnerabilities

Vulnerabilities for packages: kubevela, k3s, promxy, rancher-agent, pulumi, amazon-cloudwatch-agent-operator...

nodejs:22 security update

nodejs 1:22.23.1-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 1:22.23.1-3 - Backport patch: update sqlite to 3.53.4 Fix: CVE-2026-11824, CVE-2026-11822 Resolves: RHEL-224135 RHEL-224144 1:22.23.1-2 -...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

OPENSUSE-SU-2026:11509-1 python3-ansible-compat-26.8.0-1.1 on GA media

These are all security issues fixed in the python3-ansible-compat-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-17346

A flaw was found in pgAdmin 4. A low-privileged user can exploit a SQL injection vulnerability when object names, such as schema, table, publication, or subscription names, containing special characters are not properly escaped. When any user, including those with higher privileges, views the...

CVE-2026-68281

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...

CVE-2026-68281 drm/imagination: Count paired job fence as dependency in prepare_job()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...