GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: authentik, unleash-fips, arangodb, langfuse-fips, langfuse, ts-patch, gitlab-rails-ce-fips, dotstatsuite-supercore, kibana, sqlpad, tileserver-gl-fips, gitlab-rails-ce, unleash, actions-runner, rancher-api-ui, opensearch-dashboards, opensearch-dashboards-fips,...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: authentik, unleash-fips, arangodb, langfuse-fips, langfuse, ts-patch, gitlab-rails-ce-fips, dotstatsuite-supercore, kibana, sqlpad, tileserver-gl-fips, gitlab-rails-ce, unleash, actions-runner, rancher-api-ui, opensearch-dashboards, opensearch-dashboards-fips,...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: authentik, unleash-fips, arangodb, langfuse-fips, langfuse, ts-patch, gitlab-rails-ce-fips, dotstatsuite-supercore, kibana, sqlpad, tileserver-gl-fips, gitlab-rails-ce, unleash, actions-runner, rancher-api-ui, opensearch-dashboards, opensearch-dashboards-fips,...

GHSA-J6R3-76F7-8JCV vulnerabilities

Vulnerabilities for packages: sqlpad, unleash-proxy, langfuse-fips, langfuse, npm, unleash, opensearch-dashboards-fips, actions-runner, tileserver-gl-fips, homepage, lerna, kibana, librechat, code-server, opensearch-dashboards...

GHSA-H3MG-XC3C-68PW vulnerabilities

Vulnerabilities for packages: sqlpad, unleash-proxy, langfuse-fips, langfuse, npm, unleash, opensearch-dashboards-fips, actions-runner, tileserver-gl-fips, homepage, lerna, kibana, librechat, code-server, opensearch-dashboards...

CVE-2026-101911 vulnerabilities

Vulnerabilities for packages: sqlpad, unleash-proxy, langfuse-fips, langfuse, npm, unleash, opensearch-dashboards-fips, actions-runner, tileserver-gl-fips, homepage, lerna, kibana, librechat, code-server, opensearch-dashboards...

CLEANSTART-2026-RX76391 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-TD83938 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

Security vulnerability affects the kube-state-metrics-fips package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...

CLEANSTART-2026-AI26012 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the kube-state-metrics-fips package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...

CLEANSTART-2026-TX77163 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the kube-state-metrics-fips package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-NP15118 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the kube-state-metrics-fips package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...

CLEANSTART-2026-DO16074 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the kube-state-metrics-fips package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-QL41079 Arithmetic over induction variables in loops were not correctly checked for underflow or overflow

Security vulnerability affects the kube-state-metrics-fips package. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow...

CLEANSTART-2026-OK73778 SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass

Security vulnerability affects the kube-state-metrics-fips package. SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CLEANSTART-2026-KJ60632 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the kube-state-metrics-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

CLEANSTART-2026-WT03886 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the kube-state-metrics-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-SF83107 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the kube-state-metrics-fips package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-ON08381 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the kube-state-metrics-fips package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-ID25713 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the kube-state-metrics-fips package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-HO44930 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the kube-state-metrics-fips package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...