194981 matches found
CLEANSTART-2026-YU49777 Security fix for CVE-2026-28735 applied in: prometheus-node-exporter 1.10.2-r3, prometheus-node-exporter 1.11.1-r2, prometheus-node-exporter 1.12.1-r0, prometheus-node-exporter 1.9.1-r3
CVE-2026-28735 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-VC78563 Security fix for CVE-2026-84445 applied in: atlantis 0.47.1-r1, boring-registry 0.18.0-r1, cadvisor 0.55.1-r7, cadvisor 0.56.2-r4, cadvisor 0.57.0-r6, cadvisor 0.60.5-r2, cert-manager 1.18.6-r6, cert-manager 1.19.6-r4, cert-manager 1.20.3-r5, cert-manager 1.21.1-r1, cloudnative-pg 1.27.4-r3, cloudnative-pg 1.28.4-r2, cloudnative-pg 1.29.2-r3, cloudnative-pg 1.30.0-r2, cloudnative-pg-fips 1.30.0-r1, dex 2.42.1-r6, dex 2.43.1-r5, dex 2.44.0-r9, dex 2.45.1-r7, dynatrace-operator 1.10.1-r1, dynatrace-operator 1.10.2-r2, dynatrace-operator 1.7.3-r5, dynatrace-operator 1.8.1-r8, dynatrace-operator 1.9.0-r6, gitea 1.27.2-r2, go-discover 0_git20250325-r4, keda 2.17.2-r2, knative-serving 1.21.3-r4, knative-serving 1.22.1-r5, knative-serving 1.23.0-r1, kube-metrics-adapter 0.2.9-r4, kube-state-metrics-fips 2.17.0-r4, kube-state-metrics-fips 2.19.1-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.2.3-r1, metallb 0.16.0-r4, minio-client 0.20250721.052808-r1, opa 1.20.2-r1, opentelemetry-collector 0.154.0-r3, opentelemetry-collector-contrib 0.157.0-r2, prometheus-alertmanager 0.34.0-r2, prometheus-operator 0.91.0-r6, prometheus-operator 0.92.1-r4, rabbitmq-cluster-operator 2.20.1-r7, rabbitmq-cluster-operator 2.21.1-r4, rabbitmq-messaging-topology-operator 1.19.3-r6, rancher-fleet-agent 0.15.6-r1, rclone 1.73.5-r7, rclone 1.74.4-r2, restic 0.18.1-r9, restic-fips 0.18.1-r7, step 0.27.5-r6, step 0.28.7-r7, step 0.29.0-r6, tempo 3.0.3-r1, terraform 1.16.0-r2, vault 1.21.4-r12, vault 2.0.4-r4, velero 1.15.2-r10, velero 1.17.2-r10, velero 1.18.2-r9, velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.12.2-r9, velero-plugin-for-aws 1.13.2-r6, velero-plugin-for-csi 0.4.3-r6, velero-plugin-for-csi 0.5.1-r5, velero-plugin-for-csi 0.6.3-r7, velero-plugin-for-csi 0.7.1-r7, victoriametrics-operator 0.71.0-r4, victoriametrics-operator 0.73.1-r1, victoriametrics-operator-fips 0.71.0-r2
CVE-2026-84445 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-GE41148 Security fix for CVE-2026-77310 applied in: wso2is 7.0.0-r1, wso2is 7.1.0-r1
CVE-2026-77310 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
PT-2026-100139
ghsa-gc5v-m9x4-r6x2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
PT-2026-101447
ghsa-mxw3-3hh2-x2mh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLSA-2026-1789677164 TuxCare security update for 32 packages (16 CVEs)
TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4...
CVE-2026-54253 TS3 Manager: Reflected XSS via /api/download port parameter steals operator session
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...
CLEANSTART-2026-AA21675 Security fix for CVE-2026-54516 applied in: activemq 6.1.8-r1, activemq 6.2.8-r1, activemq 6.3.1-r1, apache-nifi 2.10.0-r3, apache-nifi 2.9.0-r5, apache-nifi-registry 2.9.0-r3, confluent-kafka 8.3.0-r1, elasticsearch 9.4.4-r4, hazelcast 5.7.0-r1, kafka 4.3.1-r1, logstash-fips 9.4.3-r1, rundeck 6.0.0-r2, rundeck 6.0.1-r0, sonarqube 26.3.0.120487-r4, strimzi-kafka-operator 1.1.0-r1, trino 480-r7
CVE-2026-54516 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CVE-2026-92951
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.98 packages and security update
Red Hat OpenShift Container Platform release 4.12.98 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...
CVE-2026-54253: Improper Neutralization of Input During Web Page Generation
TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...
CVE-2026-54339: Server-Side Request Forgery (SSRF)
Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...
GO-2026-6441 vulnerabilities
Vulnerabilities for packages: litestream, calico, cerbos, gitlab-pages, helm, commercial-grafana, smarter-device-manager, trillian, crossplane-provider-aws-codestarnotifications-fips, gcp-compute-persistent-disk-csi-driver-fips, hydra, kserve, tekton-pipelines, commercial-nginx-ingress, dapr-fips...
GO-2026-6443 vulnerabilities
Vulnerabilities for packages: jobset-fips, crossplane-provider-aws-codecommit, aws-otel-collector-fips, crossplane-provider-aws-sns-fips, crossplane-provider-keycloak-fips, crossplane-provider-aws-appmesh, crossplane-provider-aws-wafv2, spicedb-fips, tflint-fips, sigstore-scaffolding,...
GO-2026-6348 vulnerabilities
Vulnerabilities for packages: percona-server-mongodb-operator, envoy-ratelimit, flux-source-controller, velero, datadog-agent, terraform-provider-azapi, lvm-driver, redpanda, spire-controller-manager, containerd, cloud-provider-aws, scorecard, kube-vip-cloud-provider, hubble, bank-vaults, spegel,...
CLSA-2026-1789577899 TuxCare security update for 10 packages (1 CVE)
TuxCare rebuilt 10 packages to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.2...
CVE-2026-88059 vulnerabilities
Vulnerabilities for packages: kubeflow-katib...
CVE-2026-85706 vulnerabilities
Vulnerabilities for packages: gitlab-pages, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-runner-fips, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-rails-ce-fips...