CVE-2026-61634 vulnerabilities

Vulnerabilities for packages: thingsboard, cassandra-reaper, druid, zipkin, logstash...

CVE-2026-76226 Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

CVE-2026-76226 Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in bazel mod deps calls, such as within...

PT-2026-78408

Name of the Vulnerable Software and Affected Versions Renovate versions 43.65.0 through 43.102.10 Description A remote code execution issue exists in the bazel-module and bazelisk managers when the lockFileMaintenance feature is enabled. An attacker can execute arbitrary code by supplying malicio...

safer-dependencies v0.6.0

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION:...

GO-2024-2653 vulnerabilities

Vulnerabilities for packages: hubble-ui, hubble-ui-backend-fips...

GO-2026-5597 vulnerabilities

Vulnerabilities for packages: syft, flux-fips, rclone, seaweedfs-rocksdb-fips, flux, chainloop-cli-fips, gitaly, grafana, grafana-fips, syft-fips, rancher-fleet, terragrunt, upwind-agent, argo-cd, chainloop-cli, kyverno-fips, rclone-fips, gitlab-rails-ce, amazon-ssm-agent, packer-fips, telegraf,...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: argo-events, kaniko-fips, jfrog-cli, nfpm, grype-db, flux-source-controller-fips, amazon-ssm-agent-fips, chainctl-fips, commercial-chainloop-cli, dagger, flux, guac, melange, snyk-cli, chezmoi, zot, rancher-fleet, pulumi-language-dotnet, gomplate, gptscript,...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, keda-fips, splunk-otel-collector, mcp-grafana-fips, minio-operator-fips, tempo-fips, istio, loki-fips, nrdot-collector-fips, beats-fips, datadog-agent, loki, plutono, jaeger, agentbeat, karma-fips, mc-fips, minio-operator,...

GO-2024-2599 vulnerabilities

Vulnerabilities for packages: prometheus-operator-fips, tigera-operator, local-path-provisioner, wire-go, kubernetes-dashboard-metrics-scraper-fips, crossplane-provider-azure, dataplaneapi, aws-load-balancer-controller, controller-gen, flannel-cni-plugin, tigera-operator-fips,...

GO-2026-4945 vulnerabilities

Vulnerabilities for packages: cloudprober-fips, listmonk, percona-server-mongodb-operator, aactl, cosign, grpc-health-probe-fips, authentik, grpc-health-probe, melange, kyverno-notation-aws, prometheus-podman-exporter-fips, neuvector-sigstore-interface-fips, chainloop-artifact-cas, thanos-fips,...

GO-2026-5029 vulnerabilities

Vulnerabilities for packages: minio, nerdctl, fq, caddy, helm, hydra, prometheus, prometheus-operator, step, kots, flux, istio, opentelemetry-collector, external-secrets-operator, kine, vale, kyverno, kubernetes, zot, crossplane-provider-azure-authorization, crossplane-provider-azure-storage, gla...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: pulumi-language-dotnet, flux-image-automation-controller, nfpm, nuclei, argocd-image-updater, flux-source-controller, pulumi-language-java, witness, osv-scanner, gomplate, src-fingerprint, syft, kots, flux, gitsign, bom, pulumi, trivy-operator,...

GO-2024-3305 vulnerabilities

Vulnerabilities for packages: pulumi, kubevela, amazon-cloudwatch-agent-operator, k3s, promxy, rancher-agent...

nodejs:22 security update

nodejs 1:22.23.1-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 1:22.23.1-3 - Backport patch: update sqlite to 3.53.4 Fix: CVE-2026-11824, CVE-2026-11822 Resolves: RHEL-224135 RHEL-224144 1:22.23.1-2 -...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CLEANSTART-2026-VJ19248 Security fixes in sqlpad 7.5.7-r3

Package sqlpad version 7.5.7-r3 fixes 26 vulnerabilities: ghsa-2v35-w6hq-6mfw, ghsa-f6ww-3ggp-fr8h, ghsa-wh4c-j3r5-mjhp, ghsa-x6wf-f3px-wcqx, ghsa-j759-j44w-7fr8...

OPENSUSE-SU-2026:11509-1 python3-ansible-compat-26.8.0-1.1 on GA media

These are all security issues fixed in the python3-ansible-compat-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-17346

A flaw was found in pgAdmin 4. A low-privileged user can exploit a SQL injection vulnerability when object names, such as schema, table, publication, or subscription names, containing special characters are not properly escaped. When any user, including those with higher privileges, views the...