GHSA-FH64-R2VC-XVHR vulnerabilities

Vulnerabilities for packages: mlflow-fips, mlflow...

CVE-2026-33866 vulnerabilities

Vulnerabilities for packages: mlflow-fips, mlflow...

GHSA-CMXV-58FP-FM3G vulnerabilities

Vulnerabilities for packages: pinot-fips, pinot, apache-pulsar-fips, druid, tez, apache-pulsar...

CVE-2026-40490 vulnerabilities

Vulnerabilities for packages: pinot-fips, pinot, apache-pulsar-fips, druid, tez, apache-pulsar...

JLSEC-2026-277 Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can...

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process whi...

JLSEC-2026-257 Issue summary: If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or...

Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Servic...

JLSEC-2026-265 Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the...

Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS12 files. The PKCS12itemdecryptd2iex...

JLSEC-2026-272

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequenc...

JLSEC-2026-248 Issue summary: A timing side-channel which could potentially allow recovering the private key exists...

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would...

JLSEC-2026-273

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application...

JLSEC-2026-264 Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code...

Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An...

JLSEC-2026-246 Issue summary: Checking excessively long invalid RSA public keys may take a long time.

Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVPPKEYpubliccheck to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may...

java-21-openjdk security update

1:21.0.11.0.10-1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.11.0.10-1 - Update to jdk-21.0.11+10 GA - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290...

GHSA-X4MJ-7F9G-29H4 vulnerabilities

Vulnerabilities for packages: external-dns-fips, k8sgateway-fips, k8sgateway, external-dns...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kendra-fips, yunikorn-k8shim, external-dns-fips, crossplane-provider-aws-ecs, rancher-machine, flux-helm-controller-fips, gitlab-kas-fips, crossplane-provider-aws-route53-fips, gitlab-operator-fips, cephcsi-fips, crossplane-provider-azure-web,...

CVE-2026-41246 vulnerabilities

Vulnerabilities for packages: external-dns-fips, k8sgateway-fips, k8sgateway, external-dns...

CLEANSTART-2026-WL14185 spdystream is a Go library for multiplexing streams over SPDY connections

Multiple security vulnerabilities affect the velero-fips package. spdystream is a Go library for multiplexing streams over SPDY connections. See references for individual vulnerability details...

CLEANSTART-2026-VN02574 spdystream is a Go library for multiplexing streams over SPDY connections

Multiple security vulnerabilities affect the velero-fips package. spdystream is a Go library for multiplexing streams over SPDY connections. See references for individual vulnerability details...

CVE-2026-41139 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, opensearch-dashboards-fips, opensearch-dashboards, librechat...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, seaweedfs, commercial-grafana, cloudbeat-fips, opentofu-fips, sftpgo-plugin-auth, cert-manager-cmctl-fips, seaweedfs-rocksdb, external-secrets-fips, openbao, grafana-fips, seaweedfs-rocksdb-fips, cert-manager-fips, yunikorn-k8shim-fips, ratify,...