[SECURITY] Fedora 44 Update: docker-buildx-0.35.0-1.fc44

Docker CLI plugin for extended build capabilities with BuildKit...

[SECURITY] Fedora 44 Update: docker-buildkit-0.31.0-1.fc44

Concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit...

[SECURITY] Fedora 43 Update: docker-buildx-0.35.0-1.fc43

Docker CLI plugin for extended build capabilities with BuildKit...

[SECURITY] Fedora 43 Update: docker-buildkit-0.31.0-1.fc43

Concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit...

CVE-2026-53576

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576

Kestra prior to versions 1.0.45 and 1.3.21 contained an authentication filter bypass on the REST API. Requests whose path ends in /configs were treated as the public instance-config endpoint and forwarded without credential checks, allowing anonymous access to resources such as /api/v1/{tenant}/f...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: ratify, cloudbeat, aactl, slsa-verifier, tekton-chains-fips, spire-server-fips, falcoctl, kyverno, trivy-operator, zarf, crossplane-fips, tkn-fips, crossplane, kyverno-notation-aws-fips, ratify-fips, goreleaser, docker-fips, cloudbeat-fips, ko, teleport, zarf-fips,...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: ratify, cloudbeat, aactl, slsa-verifier, tekton-chains-fips, spire-server-fips, falcoctl, kyverno, trivy-operator, zarf, crossplane-fips, tkn-fips, crossplane, kyverno-notation-aws-fips, ratify-fips, goreleaser, docker-fips, cloudbeat-fips, ko, teleport, zarf-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: skaffold, tekton-pipelines, etcd-fips, prometheus-mongodb-exporter, k9s, upwind-agent, containerd, flux-fips, zitadel, knative-kafka-broker, chisel-fips, prometheus-operator, kubevela-fips, omnictl-multiarch, trivy-fips, snyk-cli, opentofu, zot,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: guac, skaffold, terragrunt, tekton-pipelines, melange, etcd-fips, prometheus-mongodb-exporter, k9s, upwind-agent, containerd, flux-fips, zitadel, knative-kafka-broker, chisel-fips, prometheus-operator, chainloop-cli-fips, kubevela-fips, chainctl, omnictl-multiarch,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-acm, kubernetes-secret-generator, melange, tekton-pipelines, crossplane-provider-aws-kinesis-fips, etcd-fips, crossplane-provider-aws-lightsail, flux-fips, crossplane-provider-aws-organizations, crossplane-fips, chainloop-cli-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-acm, kubernetes-secret-generator, melange, tekton-pipelines, crossplane-provider-aws-kinesis-fips, etcd-fips, crossplane-provider-aws-lightsail, flux-fips, crossplane-provider-aws-organizations, crossplane-fips, chainloop-cli-fips,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, etcd-fips, prometheus-mongodb-exporter, upwind-agent, containerd, zitadel, knative-kafka-broker, prometheus-operator, omnictl-multiarch, snyk-cli, opentofu, zot, frankenphp-8.2, backup-restore-operator, podman, packer-fips, vitess, spire-server,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-azure, vault-benchmark, argo-events, cilium-cli, caddy, flux-image-automation-controller, argocd-image-updater, crossplane-provider-azure-sql, crossplane-provider-azure-authorization, loki, flux-notification-controller, podman, chezmoi,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: argo-events, cilium-cli, flux-image-automation-controller, argocd-image-updater, loki, podman, chezmoi, containerd, fscrypt, gitlab-runner, pulumi-language-yaml, istio, docker-cli-buildx, kubernetes, rootlesskit, grype, cert-manager, gatus, syft, guac,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-azure, vault-benchmark, argo-events, cilium-cli, caddy, flux-image-automation-controller, argocd-image-updater, crossplane-provider-azure-sql, crossplane-provider-azure-authorization, loki, flux-notification-controller, podman, chezmoi,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: snyk-cli, prometheus, kots, cloud-provider-aws, cilium-cli, spire-server, nerdctl, aactl, loki, kaf, kubernetes-dashboard, k3s, external-dns, rancher, podman, zot, kine, minio, opentelemetry-collector, kyverno, containerd, fscrypt, telegraf, helm,...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...