GHSA-HJF4-FPHR-2H65 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, grafana-fips, elastic-agent, grafana...

CVE-2026-81872 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, grafana-fips, elastic-agent, grafana...

Security Bulletin: IBM webMethods Integration Sever is affected by multiple CVEs related to Bouncy Castle for Java FIPS jars

Summary IBM webMethods Integration Sever uses third party Bouncy Castle for Java FIPS jars that are affected by multiple CVEs. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X...

ejbca-pqc-lab

EJBCA Pure PQC Lab — ML-DSA-65 Two-Tier PKI Hierarchy A hands-on implementation of NIST FIPS 204 ML-DSA in a two-tier PKI hierarchy using EJBCA Community Edition. 📖 Full walkthrough: Building a Post-Quantum PKI: How I Signed a Root CA and Sub CA Using ML-DSA on EJBCA What This Lab Builds A comple...

CVE-2026-101912 vulnerabilities

Vulnerabilities for packages: prism, langfuse-fips, sqlpad, opensearch-dashboards-fips, unleash-proxy, npm, code-server, tileserver-gl-fips, librechat, langfuse, opensearch-dashboards, homepage, lerna, unleash, actions-runner, kibana...

CVE-2026-102278 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, foxx-cli, commitizen, langfuse, langfuse-fips, nextcloud-server, opensearch-dashboards-fips, unleash-proxy, npm, arangodb, unleash-fips, prism, dotstatsuite-supercore, ts-patch, verdaccio, sqlpad, gitlab-rails-ce-fips, authentik-fips,...

GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, foxx-cli, commitizen, langfuse, langfuse-fips, nextcloud-server, opensearch-dashboards-fips, unleash-proxy, npm, arangodb, unleash-fips, prism, dotstatsuite-supercore, ts-patch, verdaccio, sqlpad, gitlab-rails-ce-fips, authentik-fips,...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, foxx-cli, commitizen, langfuse, langfuse-fips, nextcloud-server, opensearch-dashboards-fips, unleash-proxy, npm, arangodb, unleash-fips, prism, dotstatsuite-supercore, ts-patch, verdaccio, sqlpad, gitlab-rails-ce-fips, authentik-fips,...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, foxx-cli, commitizen, langfuse, langfuse-fips, nextcloud-server, opensearch-dashboards-fips, unleash-proxy, npm, arangodb, unleash-fips, prism, dotstatsuite-supercore, ts-patch, verdaccio, sqlpad, gitlab-rails-ce-fips, authentik-fips,...

CVE-2026-101911 vulnerabilities

Vulnerabilities for packages: prism, langfuse-fips, sqlpad, opensearch-dashboards-fips, unleash-proxy, npm, code-server, tileserver-gl-fips, librechat, langfuse, opensearch-dashboards, homepage, lerna, unleash, actions-runner, kibana...

GHSA-J6R3-76F7-8JCV vulnerabilities

Vulnerabilities for packages: prism, langfuse-fips, sqlpad, opensearch-dashboards-fips, unleash-proxy, npm, code-server, tileserver-gl-fips, librechat, langfuse, opensearch-dashboards, homepage, lerna, unleash, actions-runner, kibana...

GHSA-H3MG-XC3C-68PW vulnerabilities

Vulnerabilities for packages: prism, langfuse-fips, sqlpad, opensearch-dashboards-fips, unleash-proxy, npm, code-server, tileserver-gl-fips, librechat, langfuse, opensearch-dashboards, homepage, lerna, unleash, actions-runner, kibana...

CLEANSTART-2026-TV66074 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the kube-state-metrics-fips package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

CLEANSTART-2026-ID88447 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the kube-state-metrics-fips package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-RX76391 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-TD83938 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

Security vulnerability affects the kube-state-metrics-fips package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...

CLEANSTART-2026-AI26012 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the kube-state-metrics-fips package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...

CLEANSTART-2026-TX77163 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the kube-state-metrics-fips package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-TF22707 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the kube-state-metrics-fips package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CLEANSTART-2026-NP15118 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the kube-state-metrics-fips package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...