Astra Linux – Vulnerability in PostgresSQL-15

Improper validation of the “oidvector” type in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out the possibility of attacks where confidential information is included in the disclosed bytes, but such attacks seem unlikely. Versions of PostgreSQL pri...

CVE-2026-52878

CVE-2026-52878 affects Klever-Go (versions 1.7.14–1.7.17). A nil RawData sub-message in protobuf Transaction triggers a nil-pointer panic when txVersionChecker.CheckTxVersion dereferences tx.RawData.Version without a nil check, causing a crash in the libp2p pubsub/the node process. The crash prop...

CVE-2026-64637

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account...

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

ROOT-APP-MAVEN-CVE-2026-5598 CVE-2026-5598 in org.bouncycastle:bcprov-jdk18on - Patched by Root

Root has patched CVE-2026-5598 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...

CVE-2026-65574

Unauthenticated PHP Object Injection in Abogado = 1.18 versions...

CLSA-2025-1756253007 TuxCare security update for 38 packages (18 CVEs)

TuxCare rebuilt 38 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1...

SUSE CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

MGASA-2026-0312 Updated kernel, kmod, bluez, firmware, wireless-regdb and drakx-installer-images packages fix security vulnerabilities

Upstream kernel version 6.18.39 fixes bugs and vulnerabilities. The kmod, bluez, wireless-regdb, firmware and drakx-installer-images packages have been updated to work with this new kernel...

DEBIAN-CVE-2026-55768

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...

CLEANSTART-2026-IN49367 Security fixes in grafana-alloy 1.15.0-r0

Package grafana-alloy version 1.15.0-r0 fixes 18 vulnerabilities: CVE-2026-34040, CVE-2026-33997, CVE-2026-34165, CVE-2026-33762, CVE-2026-34986...

CLEANSTART-2026-HR76710 Security fixes in eks-distro-kube-scheduler-fips 1.34.3-r0

Package eks-distro-kube-scheduler-fips version 1.34.3-r0 fixes 18 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-27140, CVE-2026-32280...

CLEANSTART-2026-RF73854 Security fixes in keda 2.18.3-r0

Package keda version 2.18.3-r0 fixes 6 vulnerabilities: CVE-2026-26958, CVE-2025-68156, CVE-2026-24051, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr...

CLEANSTART-2026-SC64306 Security fixes in prom-mysqld-exporter-fips 0.18.0-r3

Package prom-mysqld-exporter-fips version 0.18.0-r3 fixes 10 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...

CLEANSTART-2026-BJ59269 Security fixes in elastic-beats 8.18.1-r0

Package elastic-beats version 8.18.1-r0 fixes 4 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-4vq8-7jfc-9cvp, CVE-2025-54410, CVE-2026-33186...

CLEANSTART-2026-OE12787 Security fixes in apache-superset 6.0.0-r5

Package apache-superset version 6.0.0-r5 fixes 18 vulnerabilities: ghsa-pwv6-vv43-88gr, ghsa-whj4-6x5x-4v2j, ghsa-cfh3-3jmp-rvhc, ghsa-5xmw-vc9v-4wf2, ghsa-wjx4-4jcj-g98j...

CLEANSTART-2026-RH87819 Security fixes in modelmesh-runtime-adapter 0.12.0-r1

Package modelmesh-runtime-adapter version 0.12.0-r1 fixes 18 vulnerabilities: CVE-2025-58187, CVE-2025-58188, CVE-2025-61723, CVE-2025-61725, CVE-2025-47912...

CLEANSTART-2026-RO94854 Security fixes in cert-manager-fips 1.18.3-r0

Package cert-manager-fips version 1.18.3-r0 fixes 3 vulnerabilities: CVE-2025-47913, CVE-2025-58181, CVE-2025-47914...

CVE-2026-65883 Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...