CLEANSTART-2026-FP42808 Security fix for CVE-2026-56854 applied in: cadvisor 0.55.1-r6, cortex 1.20.1-r5, dex 2.44.0-r8, dynatrace-operator 1.10.1-r1, dynatrace-operator 1.10.2-r1, dynatrace-operator 1.7.3-r5, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, external-secrets-operator 2.8.0-r3, fulcio 1.8.8-r2, go-discover 0_git20250325-r4, haproxy-ingress 0.13.19-r3, haproxy-ingress 0.14.12-r4, haproxy-ingress 0.15.4-r6, haproxy-ingress 0.16.1-r6, helm 3.21.4-r1, helm 4.2.4-r2, helm-operator 1.41.1-r5, helm-operator 1.42.3-r4, keda 2.17.2-r2, knative-serving 1.21.3-r4, knative-serving 1.22.1-r4, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kyverno 1.16.4-r3, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, minio-client 0.20250721.052808-r1, octo-sts 0.8.0-r1, opa 1.20.0-r2, opentelemetry-collector 0.154.0-r2, prometheus-node-exporter 1.10.2-r5, prometheus-node-exporter 1.9.1-r5, prometheus-node-exporter-fips 1.11.1-r3, prometheus-operator 0.90.1-r4, prometheus-operator 0.91.0-r5, prometheus-redis-exporter 1.87.0-r2, prometheus-redis-exporter 1.88.0-r3, rancher-fleet-agent 0.15.6-r0, restic 0.18.1-r6, restic-fips 0.18.1-r7, step-issuer 0.10.2-r6, step-issuer 0.11.0-r6, step-issuer 0.9.11-r4, tekton-chains-fips 0.29.1-r1, trust-manager 0.22.1-r4, vault 1.20.4-r10, vault-k8s 1.4.2-r2, vault-k8s 1.5.0.r4, victoriametrics-operator 0.73.1-r1

CVE-2026-56854 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CS12925 Security fix for CVE-2026-78662 applied in: atlantis 0.47.1-r1, boring-registry 0.18.0-r1, cadvisor 0.55.1-r7, cadvisor 0.56.2-r4, cadvisor 0.57.0-r6, cadvisor 0.60.5-r2, cert-manager 1.18.6-r6, cert-manager 1.19.6-r4, cert-manager 1.20.3-r5, cert-manager 1.21.1-r1, cosign 2.6.5-r3, dex 2.42.1-r4, dex 2.43.1-r3, dex 2.44.0-r8, dex 2.45.1-r7, dynatrace-operator 1.10.2-r1, dynatrace-operator 1.7.3-r5, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, git-lfs 3.7.1-r3, gitea 1.27.2-r2, haproxy-ingress 0.13.19-r4, haproxy-ingress 0.14.12-r5, haproxy-ingress 0.15.4-r7, haproxy-ingress 0.16.1-r7, helm 3.21.4-r2, helm 4.2.4-r2, keda 2.20.2-r2, knative-serving 1.21.3-r4, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.2.3-r1, mailpit 1.29.7-r1, mailpit-fips 1.29.7-r1, minio-client 0.20250721.052808-r1, minio-operator 6.0.4-r8, minio-operator 7.0.1-r8, minio-operator 7.1.1-r8, nats-streaming 0.25.6-r7, opa 1.20.2-r2, opentelemetry-collector-contrib 0.157.0-r1, prometheus-alertmanager 0.34.0-r2, prometheus-mysqld-exporter 0.17.2-r6, prometheus-mysqld-exporter 0.18.0-r6, prometheus-mysqld-exporter 0.19.0-r5, prometheus-mysqld-exporter 0.20.0-r0, prometheus-node-exporter 1.10.2-r5, prometheus-node-exporter 1.11.1-r4, prometheus-node-exporter 1.12.1-r2, prometheus-node-exporter 1.9.1-r5, prometheus-node-exporter-fips 1.11.1-r3, prometheus-operator 0.90.1-r4, prometheus-operator 0.91.0-r5, prometheus-operator 0.92.1-r3, prometheus-redis-exporter 1.87.0-r2, prometheus-redis-exporter 1.88.0-r3, prometheus-statsd-exporter 0.28.0-r4, prometheus-statsd-exporter 0.29.0-r1, prometheus-statsd-exporter 0.30.0-r0, rclone 1.72.1-r13, rclone 1.73.5-r7, rclone 1.74.4-r2, restic 0.18.1-r8, restic-fips 0.18.1-r7, sealed-secrets 0.36.6-r5, sealed-secrets 0.37.0-r3, sealed-secrets 0.38.4-r1, step 0.27.5-r5, step 0.28.7-r6, step 0.29.0-r5, step-issuer 0.10.2-r6, step-issuer 0.9.11-r4, terraform 1.16.0-r1, tigera-operator 1.42.1-r4, trust-manager 0.21.1-r3, trust-manager 0.22.1-r4, trust-manager 0.23.0-r2, trust-manager 0.24.0-r2, vault 1.19.5-r4, vault 1.20.4-r11, vault 1.21.4-r11, vault 2.0.4-r3, vault-k8s 1.4.2-r3, velero 1.15.2-r9, velero 1.17.2-r9, velero 1.18.2-r8, velero-fips 1.18.2-r7, victoriametrics-operator 0.71.0-r3, victoriametrics-operator 0.73.1-r1, victoriametrics-operator-fips 0.71.0-r1

CVE-2026-78662 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IW43882 Security fix for CVE-2026-84304 applied in: cadvisor 0.55.1-r7, cadvisor 0.56.2-r4, cadvisor 0.57.0-r6, cadvisor 0.60.5-r2, cert-manager 1.18.6-r6, cert-manager 1.21.1-r1, cloudnative-pg 1.27.4-r3, cloudnative-pg 1.28.4-r2, cloudnative-pg 1.29.2-r3, cloudnative-pg 1.30.0-r2, cloudnative-pg-fips 1.30.0-r1, cosign 2.6.5-r3, crossplane-provider-keycloak 3.0.1-r0, dex 2.42.1-r6, dex 2.43.1-r5, dex 2.44.0-r8, dex 2.45.1-r7, dynatrace-operator 1.10.2-r1, dynatrace-operator 1.7.3-r2, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, gitea 1.27.2-r2, go-discover 0_git20250325-r4, knative-serving 1.21.3-r4, kube-metrics-adapter 0.2.9-r3, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.2.3-r1, kyverno 1.16.4-r3, loki-fips 3.7.7-r0, metallb 0.16.0-r4, minio-client 0.20250721.052808-r1, opa 1.20.0-r1, opentelemetry-collector 0.154.0-r2, opentelemetry-collector-contrib 0.156.0-r1, opentelemetry-collector-contrib 0.157.0-r1, prometheus-alertmanager 0.34.0-r2, prometheus-operator 0.91.0-r6, prometheus-operator 0.92.1-r4, prometheus-operator 0.93.1-r1, rabbitmq-cluster-operator 2.20.1-r7, rabbitmq-cluster-operator 2.21.1-r4, rabbitmq-messaging-topology-operator 1.19.3-r5, rancher-fleet-agent 0.15.6-r0, rclone 1.73.5-r7, rclone 1.74.4-r2, restic 0.18.1-r7, restic-fips 0.18.1-r7, step 0.27.5-r5, step 0.28.7-r6, step 0.29.0-r5, step-issuer 0.10.2-r6, step-issuer 0.11.0-r6, step-issuer 0.9.11-r4, tempo 3.0.3-r1, terraform 1.16.0-r1, vault 1.19.5-r4, vault 1.20.4-r10, vault 1.21.4-r11, vault 2.0.4-r3, velero 1.15.2-r9, velero 1.17.2-r9, velero 1.18.2-r8, velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.12.2-r9, velero-plugin-for-aws 1.13.2-r6, velero-plugin-for-csi 0.4.3-r5, velero-plugin-for-csi 0.5.1-r5, velero-plugin-for-csi 0.6.3-r6, victoriametrics-operator 0.71.0-r3, victoriametrics-operator 0.73.1-r1

CVE-2026-84304 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KE92927 Security fix for CVE-2026-8384 applied in: apache-nifi 2.10.0-r3, kafka 4.3.1-r2, solr 10.0.0-r6, trino 480-r10

CVE-2026-8384 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JY20850 Security fix for CVE-2021-3450 applied in: openssl 1.1.1k-r0

Security vulnerability affects the openssl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-SP18534 Security fix for CVE-2022-4304 applied in: openssl 3.0.8-r0

Security vulnerability affects the openssl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DC84124 Security fix for CVE-2026-47856 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CI69537 Security fix for CVE-2026-71290 applied in: apache-nifi 2.10.0-r8, elasticsearch 9.5.2-r3, spring-boot 3.4.13-r3, wso2is 7.2.0-r2, wso2is 7.3.0-r5

CVE-2026-71290 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BO34717 Security fix for CVE-2024-5535 applied in: openssl 3.3.1-r1

Security vulnerability affects the openssl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VA58773 Security fix for CVE-2026-85024 applied in: apache-superset 6.0.0-r7, npm 11.19.1-r0, npm 12.0.2-r0

CVE-2026-85024 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZP93019 Security fix for CVE-2026-75140 applied in: elasticsearch 9.5.2-r2

Security vulnerability affects the elasticsearch package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-KZ39555 Security fix for CVE-2026-79921 applied in: keda 2.17.2-r2, keda 2.20.2-r2, opentelemetry-collector-contrib 0.157.0-r1

CVE-2026-79921 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TA16647 Security fix for CVE-2024-38821 applied in: apache-nifi 1.25.0-r1

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RX91523 Security fix for CVE-2026-58043 applied in: nodejs 26.5.0-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LA29033 Security fix for CVE-2026-56850 applied in: nodejs 26.5.0-r0

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VC78563 Security fix for CVE-2026-84445 applied in: atlantis 0.47.1-r1, boring-registry 0.18.0-r1, cadvisor 0.55.1-r7, cadvisor 0.56.2-r4, cadvisor 0.57.0-r6, cadvisor 0.60.5-r2, cert-manager 1.18.6-r6, cert-manager 1.19.6-r4, cert-manager 1.20.3-r5, cert-manager 1.21.1-r1, cloudnative-pg 1.27.4-r3, cloudnative-pg 1.28.4-r2, cloudnative-pg 1.29.2-r3, cloudnative-pg 1.30.0-r2, cloudnative-pg-fips 1.30.0-r1, dex 2.42.1-r6, dex 2.43.1-r5, dex 2.44.0-r9, dex 2.45.1-r7, dynatrace-operator 1.10.1-r1, dynatrace-operator 1.10.2-r2, dynatrace-operator 1.7.3-r5, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, gitea 1.27.2-r2, go-discover 0_git20250325-r4, keda 2.17.2-r2, knative-serving 1.21.3-r4, knative-serving 1.22.1-r5, knative-serving 1.23.0-r1, kube-metrics-adapter 0.2.9-r4, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.2.3-r1, metallb 0.16.0-r4, minio-client 0.20250721.052808-r1, opa 1.20.2-r1, opentelemetry-collector 0.154.0-r3, opentelemetry-collector-contrib 0.157.0-r2, prometheus-alertmanager 0.34.0-r2, prometheus-operator 0.91.0-r6, prometheus-operator 0.92.1-r4, rabbitmq-cluster-operator 2.20.1-r7, rabbitmq-cluster-operator 2.21.1-r4, rabbitmq-messaging-topology-operator 1.19.3-r6, rancher-fleet-agent 0.15.6-r1, rclone 1.73.5-r7, rclone 1.74.4-r2, restic 0.18.1-r9, restic-fips 0.18.1-r7, step 0.27.5-r6, step 0.28.7-r7, step 0.29.0-r6, tempo 3.0.3-r1, terraform 1.16.0-r2, vault 1.21.4-r12, vault 2.0.4-r4, velero 1.15.2-r10, velero 1.17.2-r10, velero 1.18.2-r9, velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.12.2-r9, velero-plugin-for-aws 1.13.2-r6, velero-plugin-for-csi 0.4.3-r6, velero-plugin-for-csi 0.5.1-r5, velero-plugin-for-csi 0.6.3-r7, velero-plugin-for-csi 0.7.1-r7, victoriametrics-operator 0.71.0-r4, victoriametrics-operator 0.73.1-r1, victoriametrics-operator-fips 0.71.0-r2

CVE-2026-84445 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FQ72391 Security fix for CVE-2026-84303 applied in: cadvisor 0.55.1-r7, cadvisor 0.56.2-r4, cadvisor 0.57.0-r6, cadvisor 0.60.5-r2, cert-manager 1.18.6-r6, cert-manager 1.21.1-r1, cloudnative-pg 1.27.4-r3, cloudnative-pg 1.28.4-r2, cloudnative-pg 1.29.2-r3, cloudnative-pg 1.30.0-r2, cloudnative-pg-fips 1.30.0-r1, dex 2.42.1-r5, dex 2.43.1-r5, dex 2.44.0-r8, dex 2.45.1-r7, dynatrace-operator 1.7.3-r5, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, gitea 1.27.2-r2, go-discover 0_git20250325-r4, knative-serving 1.21.3-r4, kube-metrics-adapter 0.2.9-r3, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.2.3-r1, metallb 0.16.0-r4, minio-client 0.20250721.052808-r1, opa 1.20.0-r1, prometheus-alertmanager 0.34.0-r2, prometheus-operator 0.91.0-r6, prometheus-operator 0.92.1-r4, rabbitmq-cluster-operator 2.20.1-r7, rabbitmq-cluster-operator 2.21.1-r4, rabbitmq-messaging-topology-operator 1.19.3-r5, rclone 1.73.5-r7, rclone 1.74.4-r2, restic-fips 0.18.1-r7, tempo 3.0.3-r1, terraform 1.16.0-r1, velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.12.2-r9, velero-plugin-for-aws 1.13.2-r6, velero-plugin-for-csi 0.4.3-r5, velero-plugin-for-csi 0.5.1-r5, velero-plugin-for-csi 0.6.3-r6, victoriametrics-operator 0.73.1-r1

CVE-2026-84303 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YH52150 Security fix for CVE-2026-90560 applied in: spark-sc213-jdk17-py312 4.1.3-r2

Security vulnerability affects the spark-sc213-jdk17-py312 package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-XJ29486 Security fix for CVE-2026-85525 applied in: opentelemetry-collector-contrib 0.157.0-r2, vault 2.0.4-r5

CVE-2026-85525 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.52.0-0.1.hum1 aarch64, x8664 syft-1.52.0-0.1.hum1.src src...