Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.0.0

external secrets operator for Red Hat OpenShift 1.0.0 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...

EUVD-2026-44852

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

CVE-2026-47085

CVE-2026-47085 affects Cyrus IMAPD (up to 3.12.2). The flaw: URLAUTH token forgery via a missing mboxkey, allowing an attacker who knows a folder name the user never authorized to forge a valid URLAUTH by computing an HMAC-SHA1 with a predictable key, granting read access to the mailbox. Impact i...

coreutils security update

9.5-8.0.1 - clean up empty file if cp is failed Orabug 15973168 9.5-8 - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification RHEL-180649...

SUSE SLES15 Security Update : python-cryptography (SUSE-SU-2026:3040-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3040-1 advisory. - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. -...

Linux Distros Unpatched Vulnerability : CVE-2026-38974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py. CVE-2026-38974 Note that Nessus relies on the presence of...

Libreswan 4.6 < 5.3.1 DoS

The version of Libreswan installed on the remote host is between 4.6 and 5.3.1 exclusive. It is, therefore, affected by a denial of service vulnerability. An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. The function reassemblev2incomingfragments would...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:21341-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21341-1 advisory. This update for go1.26 fixes the following issues - Update to version go1.26.5 bsc1255111. - CVE-2026-39822: os: Root escape via symlink plus...

GHSA-7GCF-G7XR-8HXJ serde_with: KeyValueMap serialization panics on empty sequence or map entries

Summary The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through serdeasas =...

DEBIAN-CVE-2026-38974

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

UBUNTU-CVE-2026-38974

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py...

CVE-2026-56678

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443 and cause 9Router to...

CVE-2026-49279 WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json'msg', but msgToResourceId reads from...

Improper Authentication

Apollo ConfigService is vulnerable to Improper Authentication. The vulnerability is due to incorrect parsing of the appId during authentication for the raw configuration file endpoint, which allows an attacker to bypass AccessKey or management key authentication and access protected configuration...

CVE-2026-56678 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443 and cause 9Router to...

CVE-2026-56678

9Router prior to v0.5.6 is vulnerable in the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key, which builds an upstream URL from a user-controlled region value. An authenticated attacker can supply a crafted region (example: kiro-canary.local:8443#) to trigger SSRF by directing the v...

Improper Authentication

Apollo ConfigService is vulnerable to Improper Authentication. The vulnerability is due to improper validation of non-canonical appId values during authentication, which allows an attacker to bypass AccessKey or management key protections and gain unauthorized access to protected configuration da...

CVE-2026-15746

CVE-2026-15746 affects strands-agents-tools’ elasticsearch_memory tool (used with Strands Agents SDK). The tool’s schema exposed connection parameters (es_url, cloud_id, api_key); if api_key is omitted, it falls back to the operator’s ELASTICSEARCH_API_KEY and may be sent to a host chosen by an L...

CVE-2026-15746 Credential disclosure in Strands Agents Tools elasticsearch_memory tool

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearchmemory tool for agent memory storage. We identified CVE-2026-15746, a server-side request forgery SSRF issue i...