CVE-2026-54339: Server-Side Request Forgery (SSRF)

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

GO-2026-6441 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, crossplane-provider-aws-codestarnotifications-fips, falco-exporter, istio, kubeflow-pipelines, blob-csi, hydra, gitlab-pages, kuma, knative-serving, tekton-pipelines, cilium, vcluster, k8ssandra-client, kyverno, commercial-expanso-edge, kubeflow,...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: envoy-gateway, pinniped-fips, pulumi-kubernetes-operator, redpanda-console-fips, crossplane-provider-aws-codestarconnections-fips, amazon-ssm-agent, crossplane-provider-aws-appsync, crossplane-cli, virt-handler-fips, crossplane-provider-aws-backup, falcosidekick,...

GO-2026-6348 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, k8ssandra-operator, skopeo, step-issuer, crossplane-provider-family-aws, redpanda, go-discover, redis-operator, kaniko, gitlab-pages, vitess, prometheus, cloud-provider-vsphere, fulcio, kiali, jaeger, istio, goreleaser, tigera-operato...

CLSA-2026-1789577899 TuxCare security update for 10 packages (1 CVE)

TuxCare rebuilt 10 packages to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.2...

CVE-2026-88059 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

CVE-2026-85706 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-runner, gitlab-rails-ce, gitlab-pages, gitlab-runner-fips, gitlab-rails-ce-fips...

CVE-2026-78126 vulnerabilities

Vulnerabilities for packages: strongswan...

CVE-2026-54490 vulnerabilities

Vulnerabilities for packages: argo-workflows...

CVE-2026-59887 vulnerabilities

Vulnerabilities for packages: argo-workflows...

PT-2026-93327

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper...

CLSA-2026-1789478968 TuxCare security update for 11 packages (1 CVE)

TuxCare rebuilt 11 packages to address 1 CVE. Fixed in 4.0.18-tuxcare.1...

CLSA-2026-1789477857 TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 2.2.6-tuxcare.1...

CLSA-2026-1789473405 TuxCare security update for 15 packages (1 CVE)

TuxCare rebuilt 15 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.4...

CLSA-2026-1789467187 TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 9.20.3-tuxcare.1...

CVE-2026-55617: Insufficient Session Expiration

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-56830: Missing Authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CLSA-2026-1789414950 TuxCare security update for 82 packages (3 CVEs)

TuxCare rebuilt 82 packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3...

Important: Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - ffmpeg

AIPCC Security Alerts identified CVEs in the 3.5 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, prior to versions 2.2.24 and 2.7.7, the status, reinstall, and remove commands, when used with packages installed from sources via Git that contain specially crafted branch names in the repository, could allow for the execution of...