Oracle Linux 10 : yggdrasil-worker-package-manager (ELSA-2026-69099)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-69099 advisory. 0.2.3-8 - Rebuild against updated golang Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

RHEL 10 : yggdrasil-worker-package-manager (RHSA-2026:69099)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:69099 advisory. yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable...

PT-2026-96297

Name of the Vulnerable Software and Affected Versions Jazzware RT1000 Edge webUI version 20.0.1 Description The upgrade package upload functionality allows an authenticated attacker with administrative privileges to upload server-side executable files. These files are stored in a web-accessible...

CVE-2026-88738

The Jazzware RT1000 Edge webUI v. 20.0.1 is affected by an unrestricted file upload vulnerability within the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file, which is stored in a web-accessible location. This allows for rem...

CVE-2026-53940: Improper Limitation of a Pathname to a Restricted Directory

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2026-88738

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be...

CVE-2026-94424: Heap-based Buffer Overflow

A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was...

PT-2026-96270

Name of the Vulnerable Software and Affected Versions Moore Threads MTT S80 Driver Package versions prior to 340.151 Description A heap-based buffer overflow exists in the IOCTL Handler component within the mtdispkm64.sys library. The issue occurs in the sub 140001000 function and requires local...

yggdrasil-worker-package-manager security update

0.2.3-8 - Rebuild against updated golang...

CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3

CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: caddy, tempo, datadog-agent, grafana, grafana-mimir, distribution, kots, opentofu, zot, falcosidekick, aws-otel-collector, mcp-grafana, grafana-alloy, harbor-registry, fluent-bit-plugin-loki, loki, amazon-cloudwatch-agent, grafana-pyroscope, pulumi-kubernetes-operato...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: minio, db-operator, argocd-image-updater, ksops, amazon-cloudwatch-agent-operator, clickhouse-operator, datadog-operator, sqlexporter, tekton-pipelines, net-kourier, argo-rollouts, kuma, azuredisk-csi, kots, dex, percona-server-mongodb-operator, istio,...

GHSA-8WMF-6V46-5GFG vulnerabilities

Vulnerabilities for packages: prometheus-operator-fips, cloudprober-fips, backup-restore-operator-fips, dbmate, percona-server-mongodb-operator, cortex-geomys-fips, cert-manager-google-cas-issuer-fips, aactl, knative-net-istio-fips, opensearch-k8s-operator-fips, apm-server-fips, cosign,...

DEBIAN-CVE-2026-84451

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

ROOT-APP-MAVEN-CVE-2025-41232 CVE-2025-41232 in org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2025-41232 in the org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-2P49-HGCM-8545 GHSA-2p49-hgcm-8545 in svgo - Patched by Root

Root has patched GHSA-2p49-hgcm-8545 in the svgo package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-FW46047 Security fix for CVE-2020-3341 applied in: clamav 0.102.3-r0

Security vulnerability affects the clamav package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZR63822 Security fix for CVE-2025-22870 applied in: cert-manager-webhook-pdns-fips 2.2.0-r0, cfssl 1.5.0-r1, clickhouse-operator 0.25.5-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, ingress-nginx-controller 1.24.2-r0, kserve-rest-proxy 0.12.0-r3, kube-fluentd-operator 1.18.2-r0, kube-state-metrics 2.10.1-r0, kuberay-operator 1.3.2-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, prometheus 2.55.1-r3, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway-fips 1.10.0-r3, rclone 1.69.0-r0, runc 1.1.14-r0, tempo-fips 2.7.2-r0, wavefront-collector-for-kubernetes 1.13.0-r0

CVE-2025-22870 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SZ05253 Security fix for CVE-2025-47906 applied in: cert-manager-webhook-pdns-fips 2.2.0-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, harbor-registry 3.0.0.1-r2, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.6.1-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0

CVE-2025-47906 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WB96914 Security fix for CVE-2025-27144 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, fulcio 1.5.1-r0, fulcio-fips 1.5.1-r2, fulcio-fips 1.6.6-r2, harbor-fips 2.11.2-r5, kube-rbac-proxy-fips 0.16.1-r0, kube-rbac-proxy-fips 0.17.1-r0, kube-rbac-proxy-fips 0.19.1-r0, kyverno-fips 1.13.6-r10, step-ca 0.27.5-r0, step-cli 0.27.5-r1

CVE-2025-27144 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...