SUSE SLES15 Security Update : terraform-provider-null (SUSE-SU-2026:4062-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4062-1 advisory. - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies vi...

CVE-2026-82842: Improper Privilege Management

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identit...

CVE-2026-92420 Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...

CVE-2026-86814

The UsersWP - Social Login WordPress plugin (versions before 1.5.10 ) is vulnerable to an unauthenticated account takeover due to improper privilege management. The root cause is that the plugin fails to verify if a social login provider has confirmed ownership of an email address before using th...

CVE-2026-86814 UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

CVE-2026-86814 UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

CLEANSTART-2026-QD34582 flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak

Security vulnerability affects the keycloak package. A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak...

CVE-2026-92420: Authorization Bypass Through User-Controlled Key

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...

PT-2026-95766

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.2 Description The plugin fails to verify if a booking belongs to the requesting user before allowing modifications or deletions. This allows a user with...

CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. A patched version of the package is available...

CVE-2026-37236 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

CVE-2026-37236 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9. A patched version of the package is available...

CVE-2026-83530 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

CVE-2026-83530 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. An upgraded version of the package is available that resolves this issue...

CVE-2026-83530 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

CVE-2026-83530 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9. A patched version of the package is available...

CVE-2026-81869 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

CVE-2026-81869 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. An upgraded version of the package is available that resolves this issue...

CVE-2026-84445 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

CVE-2026-84445 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. An upgraded version of the package is available that resolves this issue...

CVE-2026-84445 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

CVE-2026-84445 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9. A patched version of the package is available...

CLEANSTART-2025-MP55739 Security fix for ghsa-f6x5-jh6r-wnfv applied in: cloud-provider-aws-1.34 1.34.1-r1

Security vulnerability affects the cloud-provider-aws-1.34 package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MV16544 Security fix for CVE-2026-46597 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300066.1-r1, apko 1.2.13-r0, apko 1.2.2-r2, argo-cd 3.3.5-r1, argo-cd-fips 3.1.14-r2, argo-workflows 4.0.5-r0, authservice 1.1.5-r1, authservice 1.1.6-r1, cadvisor 0.55.1-r1, cadvisor 0.57.0-r0, cadvisor-fips 0.55.1-r0, calico 3.30.7-r2, cert-manager 1.17.4-r2, cert-manager 1.18.6-r1, cert-manager 1.20.0-r0, cert-manager 1.20.2-r0, cert-manager-webhook-pdns-fips 2.5.5-r1, cfssl 1.5.0-r1, cluster-autoscaler 1.35.2-r2, consul 2.0.1-r0, cortex 1.21.0-r2, cosign 3.0.6-r1, crossplane-provider-sql-fips 0.15.0-r3, dynatrace-operator 1.6.3-r1, elastic-beats 8.19.15-r5, elastic-beats 9.2.8-r2, elastic-beats-fips 9.2.8-r0, external-secrets-fips 0.17.0-r2, external-secrets-operator 2.5.0-r1, flux-image-automation-controller 1.2.1-r1, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r1, fulcio-fips 1.7.1-r3, gostatsd 28.3.0-r2, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, haproxy-ingress 0.14.12-r1, helm 4.0.5-r2, helm-operator 1.42.2-r0, istio 1.28.5-r3, istio 1.29.2-r1, istio-fips 1.26.8-r4, istio-fips 1.27.9-r2, istio-fips 1.30.0-r1, kube-rbac-proxy 0.20.2-r2, kube-rbac-proxy 0.21.2-r0, kube-rbac-proxy-fips 0.20.2-r2, kube-state-metrics 2.10.1-r2, kube-state-metrics-fips 2.18.0-r1, kube-vip 1.1.0-r1, kubernetes 1.36.1-r0, kubernetes-csi-external-provisioner-fips 6.1.0-r4, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-csi-external-resizer-fips 2.1.0-r1, kubernetes-csi-external-snapshotter-fips 8.4.0-r4, kubernetes-event-exporter 1.7-r1, kubernetes-event-exporter-fips 1.7-r0, local-static-provisioner 2.8.0-r2, melange 0.50.0-r1, melange 0.56.1-r1, memcached-exporter 0.16.0-r0, minio-client 0.20250721.052808-r1, mongodb 7.0.32-r1, mongodb 8.0.20-r1, mongodb 8.0.21-r1, mongodb 8.2.6-r1, mongodb 8.3.2-r1, ollama 0.20.3-r2, ollama 0.31.2-r2, ollama 0.32.11-r2, ollama-fips 0.32.11-r2, opa 1.17.0-r1, percona-server-mongodb-operator 1.22.0-r1, percona-server-mongodb-operator 1.23.0-r0, policy-controller-fips 0.15.1-r1, postgres-operator 1.12.2-r2, postgres-operator 1.15.1-r1, prometheus 3.11.2-r0, prometheus 3.5.2-r1, prometheus-alertmanager 0.32.0-r1, prometheus-blackbox-exporter 0.28.0-r2, prometheus-mysqld-exporter 0.15.0-r2, prometheus-node-exporter-fips 1.11.1-r1, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.11.3-r1, prometheus-pushgateway 1.8.0-r1, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r1, prometheus-pushgateway-fips 1.8.0-r2, prometheus-redis-exporter-fips 1.84.0-r0, prometheus-redis-exporter-fips 1.87.0-r3, promxy-fips 0.0.93-r1, pulumi-kubernetes-operator 2.7.0-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, rancher-fleet-agent 0.12.17-r3, rancher-fleet-agent 0.13.13-r1, rancher-fleet-agent 0.14.10-r1, rancher-fleet-agent 0.14.8-r3, rancher-fleet-agent 0.15.4-r3, rancher-fleet-agent 0.15.6-r0, rancher-fleet-agent 0.16.1-r1, rclone 1.69.0-r3, restic-fips 0.18.1-r7, rundeck 6.0.0-r0, sealed-secrets 0.34.0-r0, sealed-secrets 0.35.0-r4, sealed-secrets 0.36.6-r1, secrets-store-csi-driver-provider-gcp 1.15.0-r1, secrets-store-csi-driver-provider-gcp 1.17.0-r2, spire-server 1.13.5-r1, spire-server 1.14.5-r1, spire-server-fips 1.14.5-r1, step-ca-fips 0.30.2-r1, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, syft 1.45.0-r2, tempo 2.10.4-r1, temporal 1.5.1-r0, temporal-server 1.31.0.153.1-r0, temporal-ui-server-fips 2.51.1-r1, terraform 1.14.8-r2, tigera-operator 1.42.0-r0, tigera-operator-fips 1.37.2-r4, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.45.0-r1, tkn-fips 0.44.2-r0, trust-manager-fips 0.20.3-r2, trust-manager-fips 0.21.1-r2, vault 1.20.4-r5, vault 1.21.4-r5, vault 2.0.0-r1, vault-k8s 1.7.4-r0, velero 1.18.1-r0, velero-fips 1.18.2-r6, weaviate 1.37.4-r1, weaviate 1.37.6-r1, weaviate-fips 1.36.17-r0, weaviate-fips 1.37.9-r0, weaviate-fips 1.38.1-r0

CVE-2026-46597 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IY00574 Security fix for ghsa-jpcw-4wr7-c3vq applied in: crossplane-provider-keycloak-fips 2.21.1-r1, grafana 12.3.10-r1, grafana 12.3.8-r2, grafana 12.4.5-r2, grafana 12.4.6-r0, grafana 12.4.7-r1, grafana 13.0.5-r1

ghsa-jpcw-4wr7-c3vq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QG09964 Security fix for CVE-2026-5160 applied in: crossplane-provider-keycloak 2.22.1-r2, pulumi 3.248.0-r0

CVE-2026-5160 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...