GHSA-X4MJ-7F9G-29H4 vulnerabilities

Vulnerabilities for packages: external-dns, external-dns-fips, k8sgateway-fips, k8sgateway...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, step-fips, authentik, istio, crossplane-provider-aws-emr-fips, external-dns-fips, crossplane-provider-aws-cloudfront, crossplane-provider-azure-portal, teleport, crossplane-provider-azure-notificationhubs, cert-manager-google-cas-issuer...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, step-fips, authentik, istio, crossplane-provider-aws-emr-fips, external-dns-fips, crossplane-provider-aws-cloudfront, crossplane-provider-azure-portal, teleport, crossplane-provider-azure-notificationhubs, cert-manager-google-cas-issuer...

GHSA-X4MJ-7F9G-29H4 vulnerabilities

Vulnerabilities for packages: k8sgateway, external-dns...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, amazon-cloudwatch-agent-operator, rancher-machine, crossplane-provider-azure-managedidentity, crossplane-provider-aws-cloudwatchlogs, flux-image-reflector-controller, crossplane-provider-aws-ec2, flux-image-automation-controller, slsa-verifier,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, amazon-cloudwatch-agent-operator, rancher-machine, crossplane-provider-azure-managedidentity, crossplane-provider-aws-cloudwatchlogs, flux-image-reflector-controller, crossplane-provider-aws-ec2, flux-image-automation-controller, slsa-verifier,...

CVE-2026-6941

A flaw was found in radare2. A local attacker can exploit this path traversal vulnerability by importing a specially crafted .zrp archive. This malicious archive contains a symlinked notes.txt file that bypasses directory confinement checks, allowing the attacker to read or write arbitrary files...

CVE-2026-41988

A flaw was found in uuid. When external output buffers are used with UUID versions 3, 5, or 6, an attacker with local access may be able to cause unexpected data writes. This vulnerability could lead to low impact data integrity issues. UUID version 4 is not affected...

CVE-2026-41246 vulnerabilities

Vulnerabilities for packages: k8sgateway, external-dns...

CVE-2026-41246 vulnerabilities

Vulnerabilities for packages: external-dns, external-dns-fips, k8sgateway-fips, k8sgateway...

[SECURITY] Fedora 44 Update: qt6-qtwebsockets-6.10.3-1.fc44

The QtWebSockets module implements the WebSocket protocol as specified in RFC 6455. It solely depends on Qt no external dependencies...

[SECURITY] Fedora 44 Update: goose-1.23.2-8.fc44

Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...

[SECURITY] Fedora 44 Update: libgsasl-1.10.0-15.fc44

The library includes support for the SASL framework and at least partial support for the CRAM-MD5, EXTERNAL, GSSAPI, ANONYMOUS, PLAIN, SECURID, DIGEST-MD5, LOGIN, and NTLM mechanisms...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: cert-manager, rancher, kyverno, k6, percona-server-mongodb-operator, teleport, rclone, yunikorn-k8shim, juicefs, nuclei, flux, rancher-agent, openbao, grafana, cert-manager-istio-csr, rancher-webhook, opentofu, telegraf, frp, cert-manager-csi-driver, gitlab-runner,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: cert-manager, rancher, kyverno, k6, percona-server-mongodb-operator, teleport, rclone, yunikorn-k8shim, juicefs, nuclei, flux, rancher-agent, openbao, grafana, cert-manager-istio-csr, rancher-webhook, opentofu, telegraf, frp, cert-manager-csi-driver, gitlab-runner,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: neuvector-fips, k6, flux-source-controller-fips, frp, beats, agentbeat-fips, minio-fips, seaweedfs, juicefs, external-secrets-operator-fips, ratify-fips, teleport, external-secrets-operator, cert-manager-google-cas-issuer, nuclei, openbao-fips, neuvector, rclone-fips...

CVE-2026-41907 uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...

CVE-2026-41907

uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes small buf or large offset. This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0...

CVE-2026-41066

CVE-2026-41066 affects the Python XML/HTML library lxml . In versions prior to 6.1.0, using the two parsers with the default setting resolve_entities=True allows untrusted XML input to read local files. Setting the option to resolve_entities='internal' or resolve_entities=False disables local fil...

CVE-2026-41066 lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration with resolveentities=True allows untrusted XML input to read local files. Setting the resolveentities option explicitly to resolveentities='internal' ...