4450 matches found
CLEANSTART-2026-YD35232 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...
Multiple security vulnerabilities affect the tekton-pipelines-fips package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See...
CLEANSTART-2026-FK30234 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...
Multiple security vulnerabilities affect the tekton-pipelines-fips package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See...
GHSA-46R5-X6JQ-V8G6 vulnerabilities
Vulnerabilities for packages: mlflow, mlflow-fips...
GHSA-FH64-R2VC-XVHR vulnerabilities
Vulnerabilities for packages: mlflow, mlflow-fips...
CVE-2026-33866 vulnerabilities
Vulnerabilities for packages: mlflow, mlflow-fips...
CVE-2026-33865 vulnerabilities
Vulnerabilities for packages: mlflow, mlflow-fips...
GHSA-CMXV-58FP-FM3G vulnerabilities
Vulnerabilities for packages: druid, apache-pulsar-fips, apache-pulsar, pinot-fips, pinot, tez...
CVE-2026-40490 vulnerabilities
Vulnerabilities for packages: druid, apache-pulsar-fips, apache-pulsar, pinot-fips, pinot, tez...
JLSEC-2026-257 Issue summary: If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or...
Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Servic...
JLSEC-2026-277 Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can...
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process whi...
JLSEC-2026-248 Issue summary: A timing side-channel which could potentially allow recovering the private key exists...
Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would...
JLSEC-2026-264 Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code...
Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...
JLSEC-2026-265 Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the...
Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS12 files. The PKCS12itemdecryptd2iex...
JLSEC-2026-273
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application...
JLSEC-2026-272
Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequenc...
JLSEC-2026-246 Issue summary: Checking excessively long invalid RSA public keys may take a long time.
Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVPPKEYpubliccheck to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may...
java-21-openjdk security update
1:21.0.11.0.10-1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.11.0.10-1 - Update to jdk-21.0.11+10 GA - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290...
GHSA-X4MJ-7F9G-29H4 vulnerabilities
Vulnerabilities for packages: external-dns-fips, k8sgateway-fips, external-dns, k8sgateway...
CVE-2026-29181 vulnerabilities
Vulnerabilities for packages: step-issuer-fips, crossplane-provider-aws-memorydb-fips, k6-fips, crossplane-provider-aws-secretsmanager-fips, longhorn-manager, crossplane-provider-sql-fips, thanos-receive-controller, cadvisor-fips, crossplane-provider-azure-servicefabric,...