GHSA-558V-64GR-WGG4 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, infinispan, zookeeper, keycloak, cloudwatch-exporter, flyway, tez, cassandra, apache-activemq-artemis, thingsboard, apicurio-registry, akhq, apache-nifi, management-api-for-apache-cassandra-5.0, neo4j, strimzi-kafka-operator, apache-pulsar,...

CVE-2026-59901 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, infinispan, zookeeper, keycloak, cloudwatch-exporter, flyway, tez, cassandra, apache-activemq-artemis, thingsboard, apicurio-registry, akhq, apache-nifi, management-api-for-apache-cassandra-5.0, neo4j, strimzi-kafka-operator, apache-pulsar,...

GHSA-558V-64GR-WGG4 vulnerabilities

Vulnerabilities for packages: apicurio-registry, cloudwatch-exporter, floci, camunda-zeebe, apache-hop, wavefront-proxy, camunda, infinispan, kafka, spark-kubernetes-operator, apicurio-registry-fips, kafka-bridge, kayenta, knative-kafka-broker, neo4j, pinot-fips, nuxeo, cassandra, s3proxy,...

CVE-2026-59901 vulnerabilities

Vulnerabilities for packages: apicurio-registry, cloudwatch-exporter, floci, camunda-zeebe, apache-hop, wavefront-proxy, camunda, infinispan, kafka, spark-kubernetes-operator, apicurio-registry-fips, kafka-bridge, kayenta, knative-kafka-broker, neo4j, pinot-fips, nuxeo, cassandra, s3proxy,...

Important: Red Hat Security Advisory: satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-advisor-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. This adds the satellite/iop-advisor-engine-rhel9 image to the Red Hat container registry. To pull this container image, run the following command: podman pull...

EUVD-2026-47593

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16489

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

PT-2026-64053

These are all security issues fixed in the distribution-registry-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11328-1 distribution-registry-3.1.1-4.1 on GA media

These are all security issues fixed in the distribution-registry-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-16489 jsforce SFDX Connection Registry sfdx.js _execCommand os command injection

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16489

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

CVE-2026-16489

CVE-2026-16489 affects jsforce up to 3.10.16 in the SFDX Connection Registry. The vulnerability targets the function _execCommand within lib/registry/sfdx.js, enabling OS command injection from a local environment. An exploit is publicly available; the issue was reported early but no remediation ...

CVE-2026-16489 jsforce SFDX Connection Registry sfdx.js _execCommand os command injection

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea's Debian package registry parser contains an unbounded decompression vulnerability in ParseControlFile. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the entire uncompressed stream into a strings.Builder via a TeeReader, with no limit on how much...

GHSA-9MQ6-MQJJ-C2C5 Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Gitea records non-dot regular file entries...

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Gitea records non-dot regular file entries...

EUVD-2026-43960

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry...

GHSA-PF56-329R-95RW Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

Impact This is a credential-exposure / credential-confusion issue. getRegistryCredentials reads credentials from the Docker config file /.docker/config.json and selects an entry by checking whether any configured auth key contains the target registry string: js Object.keysdockerConfig.auths ||...

SUSE-SU-2026:22650-1 Security update for helm

This update for helm fixes the following issue - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens bsc1270127. Changes for helm: - Update to version 3.21.2...

CLEANSTART-2026-SO51158 Security fixes for CVE-2021-3538, CVE-2025-29923, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24051, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-39882 applied in versions: 3.0.0.1-r3, 3.0.0.1-r4, 3.0.0.1-r5, 3.1.1-r0

Multiple security vulnerabilities affect the harbor-registry-fips package. These issues are resolved in later releases. See references for individual vulnerability details...