CVE-2026-49233

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache...

CLEANSTART-2026-VH00240 Security fixes for CVE-2024-45993, CVE-2025-11143, CVE-2025-31344, CVE-2026-1605, CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-42504, CVE-2026-42507, ghsa-3677-xxcr-wjqv, ghsa-72hv-8253-57qq, ghsa-vc5p-v9hr-52mj applied in versions: 4.0.1-r0, 4.0.1-r1, 4.0.1-r2, 4.0.1-r3, 4.3.0-r0

Multiple security vulnerabilities affect the kafka package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FA38569 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-39821, CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 0.16.0-r0, 0.16.0-r1

Multiple security vulnerabilities affect the memcached-exporter package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MI06133 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 0.36.1-r0, 0.36.6-r0, 0.36.6-r1, 0.37.0-r0

Multiple security vulnerabilities affect the sealed-secrets package. These issues are resolved in later releases. See references for individual vulnerability details...

EUVD-2026-35063

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache...

CLEANSTART-2026-FU07345 Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-2025-27516, CVE-2025-32962, CVE-2025-43859, CVE-2025-4565, CVE-2025-53643, CVE-2025-57804, CVE-2025-58065, CVE-2025-68480, CVE-2025-69223, CVE-2025-69224, CVE-2025-69225, CVE-2025-69226, CVE-2025-69227, CVE-2025-69228, CVE-2025-69229, CVE-2025-69230, CVE-2026-0994, CVE-2026-21226, CVE-2026-22815, CVE-2026-23490, CVE-2026-26007, CVE-2026-27205, CVE-2026-34073, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-41066, CVE-2026-41205, CVE-2026-44307, CVE-2026-44405, CVE-2026-44503, CVE-2026-45409, ghsa-27jp-wm6q-gp25, ghsa-27mf-ghqm-j3j8, ghsa-29h4-r29x-hchv, ghsa-2g68-c3qc-8985, ghsa-2h4p-vjrc-8xpq, ghsa-2vrm-gr82-f7m5, ghsa-2xpw-w6gg-jr37, ghsa-38jv-5279-wg99, ghsa-3wq7-rqq7-wx6j, ghsa-428g-f7cq-pgp5, ghsa-5239-wwwm-4pmq, ghsa-54jq-c3m8-4m76, ghsa-58pv-8j8x-9vj2, ghsa-5rjg-fvgr-3xxf, ghsa-63hf-3vf5-4wqf, ghsa-63vm-454h-vhhq, ghsa-65pc-fj4g-8rjx, ghsa-68rp-wp8r-4726, ghsa-6jhg-hg63-jvvf, ghsa-6mq8-rvhq-8wgg, ghsa-752w-5fwx-jx9f, ghsa-765j-9r45-w2q2, ghsa-78cv-mqj4-43f7, ghsa-79v4-65xg-pq4g, ghsa-7cx3-6m66-7c5m, ghsa-7gcm-g887-7qv7, ghsa-7j59-v9qr-6fq9, ghsa-847f-9342-265h, ghsa-8495-4g3g-x7pr, ghsa-87hc-h4r5-73f7, ghsa-8qvm-5x2c-j2w7, ghsa-8rrh-rw8j-w5fx, ghsa-8w49-h785-mj3c, ghsa-9548-qrrj-x5pj, ghsa-966j-vmvw-g2g9, ghsa-9hjg-9r4m-mvj7, ghsa-c427-h43c-vf67, ghsa-cpwx-vrp4-4pq7, ghsa-f9vj-2wh5-fj8j, ghsa-fh55-r93g-j68g, ghsa-fqwm-6jpj-5wxc, ghsa-g84x-mcqj-x9qq, ghsa-gc5v-m9x4-r6x2, ghsa-gm62-xv2j-4w53, ghsa-gmj6-6f8f-6699, ghsa-h4gh-qq45-vh27, ghsa-hcc4-c3v8-rx92, ghsa-hgf8-39gv-g3f2, ghsa-hrfv-mqp8-q5rw, ghsa-jm66-cg57-jjv5, ghsa-jr27-m4p2-rc6r, ghsa-m5qp-6w8w-w647, ghsa-mf9w-mj56-hr94, ghsa-mrfv-m5wm-5w6w, ghsa-mwh4-6h8g-pg8w, ghsa-p8q5-cvwx-wvwp, ghsa-p998-jp59-783m, ghsa-pq67-6m6q-mj2v, ghsa-q2x7-8rv6-6q7h, ghsa-q34m-jh98-gwm2, ghsa-qccp-gfcp-xxvc, ghsa-qjxf-f2mg-c6mc, ghsa-r244-wg5g-6w2r, ghsa-r6ph-v2qm-q3c2, ghsa-v92g-xgxw-vvmm, ghsa-vfmq-68hx-4jfw, ghsa-vqfr-h8mv-ghfj, ghsa-w2fm-2cpv-w7v5 applied in versions: 2.10.3-r0, 2.10.3-r2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-47430 Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

CVE-2026-47430 Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

EUVD-2026-35041

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

CVE-2026-47430 Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

Summary The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation CDVWKInAppBrowser.m:560–574. Any web content loaded inside the InAppBrowser can fire any pending Cordova callback...

[SECURITY] [DLA 4621-1] glibc security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4621-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout June 08, 2026 https://wiki.debian.org/LTS -...

CVE-2026-41838: Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules...

Debian dsa-6325 : chromium - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6325 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6325-1 [email protected]...

RHEL 10 : frr (RHSA-2026:24347)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24347 advisory. FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR...

Generation of Predictable Numbers or Identifiers

Overview org.springframework:spring-websocket is a framework that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Generation of Predictable Numbers ...

CVE-2026-46486: Improper Limitation of a Pathname to a Restricted Directory

MVT Mobile Verification Toolkit helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.12, there is a path traversal vulnerability via unsanitized File identifiers in iOS Backup processing. This issue has been patched in version...

ALSA-2026:24338 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

MINI-QM2F-CWH4-Q6R7

Bulletin has no description...

CVE-2026-8839

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via MappressApi::restapiinit, where the GET...

Fedora 44 : webkitgtk (2026-a63aad0224)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a63aad0224 advisory. Add support for half-width fonts. Improve content filter compilation by avoiding file copies. Improve handling of out of disk space conditions when...