CLEANSTART-2026-FQ72391 Security fix for CVE-2026-84303 applied in: cadvisor 0.55.1-r7, cadvisor 0.56.2-r4, cadvisor 0.57.0-r6, cadvisor 0.60.5-r2, cert-manager 1.18.6-r6, cert-manager 1.21.1-r1, cloudnative-pg 1.27.4-r3, cloudnative-pg 1.28.4-r2, cloudnative-pg 1.29.2-r3, cloudnative-pg 1.30.0-r2, cloudnative-pg-fips 1.30.0-r1, dex 2.42.1-r5, dex 2.43.1-r5, dex 2.44.0-r8, dex 2.45.1-r7, dynatrace-operator 1.7.3-r5, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, gitea 1.27.2-r2, go-discover 0_git20250325-r4, knative-serving 1.21.3-r4, kube-metrics-adapter 0.2.9-r3, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.2.3-r1, metallb 0.16.0-r4, minio-client 0.20250721.052808-r1, opa 1.20.0-r1, prometheus-alertmanager 0.34.0-r2, prometheus-operator 0.91.0-r6, prometheus-operator 0.92.1-r4, rabbitmq-cluster-operator 2.20.1-r7, rabbitmq-cluster-operator 2.21.1-r4, rabbitmq-messaging-topology-operator 1.19.3-r5, rclone 1.73.5-r7, rclone 1.74.4-r2, restic-fips 0.18.1-r7, tempo 3.0.3-r1, terraform 1.16.0-r1, velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.12.2-r9, velero-plugin-for-aws 1.13.2-r6, velero-plugin-for-csi 0.4.3-r5, velero-plugin-for-csi 0.5.1-r5, velero-plugin-for-csi 0.6.3-r6, victoriametrics-operator 0.73.1-r1

CVE-2026-84303 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

ROOT-APP-NPM-CVE-2024-56332 CVE-2024-56332 in next - Patched by Root

Root has patched CVE-2024-56332 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-14257 CVE-2026-14257 in brace-expansion - Patched by Root

Root has patched CVE-2026-14257 in the brace-expansion package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-69152 CVE-2026-69152 in brace-expansion - Patched by Root

Root has patched CVE-2026-69152 in the brace-expansion package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-39693 CVE-2024-39693 in next - Patched by Root

Root has patched CVE-2024-39693 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-34350 CVE-2024-34350 in next - Patched by Root

Root has patched CVE-2024-34350 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-23646 CVE-2022-23646 in next - Patched by Root

Root has patched CVE-2022-23646 in the next package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-CA42372 norm

Multiple security vulnerabilities affect the mailpit package. A norm. See references for individual vulnerability details...

EUVD-2026-82495

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

PT-2026-100499

Security vulnerability affects the npm package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101757

Security vulnerability affects the rust package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-102192

Security vulnerability affects the rust package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2026-16582 Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

CVE-2026-16582

The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to unauthenticated payment bypass in versions up to and including 2.4.5 . The root cause is that the plugin accepts a client-supplied package-redemption identifier as proof of payment without properly validat...

DEBIAN-CVE-2026-52727

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-52727

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-90137

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

AZL-102794 CVE-2026-90137 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

DEBIAN-CVE-2026-90137

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...