org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length

A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...

golang-fips: Golang FIPS zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

Oracle Linux 10 : openssl-fips-provider (ELSA-2026-27746)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-27746 advisory. 3.0.7-11.0.1 - Add bundle with Oracle Linux 9 OpenSSL FIPS module packages Orabug: 40015480 - Update extract-src.sh script to support non-hobbled openssl...

BIT-ZOOKEEPER-2026-59969 Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

CVE-2026-82399 vulnerabilities

Vulnerabilities for packages: juicefs, eks-distro-fips, k8sgateway-fips, k8sgateway, kubernetes-dns-node-cache, eks-distro, kubernetes-dns-node-cache-fips...

GHSA-9GM5-9RFH-M6VX vulnerabilities

Vulnerabilities for packages: juicefs, eks-distro-fips, k8sgateway-fips, k8sgateway, kubernetes-dns-node-cache, eks-distro, kubernetes-dns-node-cache-fips...

CVE-2026-86003 vulnerabilities

Vulnerabilities for packages: juicefs, eks-distro-fips, k8sgateway-fips, k8sgateway, kubernetes-dns-node-cache, eks-distro, kubernetes-dns-node-cache-fips...

GHSA-MRG3-QVQR-JW29 vulnerabilities

Vulnerabilities for packages: juicefs, eks-distro-fips, k8sgateway-fips, k8sgateway, kubernetes-dns-node-cache, eks-distro, kubernetes-dns-node-cache-fips...

CVE-2026-85721 vulnerabilities

Vulnerabilities for packages: apache-pulsar, pinot, tez, pinot-fips, apache-pulsar-fips, druid...

CVE-2026-85717 vulnerabilities

Vulnerabilities for packages: apache-pulsar, pinot, tez, pinot-fips, apache-pulsar-fips, druid...

GHSA-F8M2-889X-VW4X vulnerabilities

Vulnerabilities for packages: apache-pulsar, pinot, tez, pinot-fips, apache-pulsar-fips, druid...

GHSA-7GRG-JCF7-RPMX vulnerabilities

Vulnerabilities for packages: apache-pulsar, pinot, tez, pinot-fips, apache-pulsar-fips, druid...

CVE-2026-86000 vulnerabilities

Vulnerabilities for packages: airflow, datadog-agent-fips, open-webui...

CVE-2026-85999 vulnerabilities

Vulnerabilities for packages: airflow, datadog-agent-fips, open-webui...

GHSA-GJV8-XP57-G29C vulnerabilities

Vulnerabilities for packages: airflow, datadog-agent-fips, open-webui...

GHSA-J934-XHV5-FG8F vulnerabilities

Vulnerabilities for packages: airflow, datadog-agent-fips, open-webui...

PT-2026-95844

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

GHSA-H7VF-4X9W-H99V vulnerabilities

Vulnerabilities for packages: gitlab-operator, chaos-mesh, kube-arangodb, consul-k8s-fips, helm-mapkubeapis, opentofu, opentofu-fips, tigera-operator-fips, flux-helm-controller, cert-manager-cmctl, chaos-mesh-fips, xeol-fips, kube-arangodb-fips, ocm-cli, ocm-kubernetes-controller, cloudbeat-fips,...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: plutono-fips, trivy-operator-fips, victoriametrics-operator, ld-relay-fips, kubernetes-event-exporter, redpanda-console, metrics-server, rancher-webhook-fips, cert-manager-cmctl, chaos-mesh-fips, gubernator, neuvector, newrelic-k8s-metrics-adapter, policy-controller,...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: gitlab-operator, chaos-mesh, kube-arangodb, consul-k8s-fips, helm-mapkubeapis, opentofu, opentofu-fips, tigera-operator-fips, flux-helm-controller, cert-manager-cmctl, chaos-mesh-fips, xeol-fips, kube-arangodb-fips, ocm-cli, ocm-kubernetes-controller, cloudbeat-fips,...