CLSA-2026-1789228568 TuxCare security update for io.netty (2 CVEs)

TuxCare rebuilt 47 io.netty packages to address 2 CVEs. Fixed in 4.1.119.Final-tuxcare.3...

CLSA-2026-1789219941 TuxCare security update for io.netty (1 CVE)

TuxCare rebuilt 47 io.netty packages to address 1 CVE. Fixed in 4.1.117.Final-tuxcare.4...

EUVD-2026-76767

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CLSA-2026-1789159895 TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 6.30.3-tuxcare.2...

CLSA-2026-1789159265 TuxCare security update for 123 packages (1 CVE)

TuxCare rebuilt 123 packages to address 1 CVE. Fixed in 11.0.31.tuxcare0001...

GHSA-7JXH-36Q5-GCQV vulnerabilities

Vulnerabilities for packages: zot, docker-compose, grype-fips, amazon-ecs-agent-fips, cloudbeat-fips, kgateway-fips, docker-cli-buildx-fips, nerdctl-fips, kubevela-fips, crossplane-cli, crossplane-cli-fips, fuse-overlayfs-snapshotter, manifest-tool, docker-compose-fips, chainctl, teleport,...

CVE-2026-53495 vulnerabilities

Vulnerabilities for packages: datadog-agent, steampipe, dagger, kube-arangodb, wolfictl, helm-push, kubescape-operator, k8sgpt, docker, trivy-operator, zot, scorecard, kubevela, zarf, syft, k8ssandra-client, k9s, kargo, chartmuseum, gatekeeper, helm-operator, kaniko, buildkitd, spegel, rancher,...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +36 more potentially affected by CVE-2026-88057 via @angular/compiler (>=20.0.0, <=20.3.21)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-88057 Source advisory:...

CLSA-2026-1789069337 TuxCare security update for 2 packages (2 CVEs)

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 5.0.2-tuxcare.1...

CVE-2026-88892 OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch on config.fileUrl, which is validated only by...

CLSA-2026-1789031241 TuxCare security update for 9 packages (1 CVE)

TuxCare rebuilt 9 packages to address 1 CVE. Fixed in 5.18.1-tuxcare.6...

CVE-2026-53113 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-aws...

GHSA-4C74-G9CQ-VHC5 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-75596 vulnerabilities

Vulnerabilities for packages: seata, flyway-fips, cassandra-reaper, keycloak, spark-fips, kafka, akhq, apache-hop, zookeeper, pinot, druid, request-9047-keycloak-fips, hadoop-fips, floci-az, sonarqube, strimzi-kafka-operator, elasticsearch-fips, neo4j, spark, kayenta-fips, cassandra-fips,...

sherlock v0.16.2

Hunt down social media accounts by username across 400+ social networks Installation • Usage • Contributing Installation !WARNING Packages for ParrotOS and Ubuntu 24.04, maintained by a third party, appear to be broken. Users of these systems should defer to uv/pipx/pip or Docker. Method| Notes...

CVE-2026-84375 vulnerabilities

Vulnerabilities for packages: code-server, pulumi, sqlpad, vitess, jupyter-base-notebook, kubeflow-katib, ts-patch, prism, renovate, opensearch-dashboards, argo-workflows, eslint, lerna...

RHEL 9 : RHEL AI 3.6 RPM runtime CVE fix - ffmpeg (Important) (RHSA-2026:66381)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66381 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...

RockyLinux 10 : osbuild-composer (RLSA-2026:65895)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65895 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 net/mail: golang: net/mai...

GHSA-3MCP-22MF-VRW3 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, librechat, prism, opensearch-dashboards, nextcloud-server, wazuh-dashboard, kibana, semaphore, awx, gitlab-rails-ce-fips, opensearch-dashboards-fips, kubeflow-centraldashboard, wazuh-dashboard-fips, lerna, gitlab-rails-ce, langfuse, azurite,...