[SECURITY] Fedora 44 Update: openbao-2.5.5-1.fc44

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

EUVD-2026-39498

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run...

CVE-2026-55069

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computatio...

CVE-2026-49984

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past...

CVE-2026-55069 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computatio...

CVE-2026-55069

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computatio...

CVE-2026-55069 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computatio...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: trivy-fips, chisel-fips, external-dns, kube-state-metrics, etcd, knative-kafka-broker-fips, argo-cd, trivy, kots, cilium, kubernetes-dashboard, spire-server, nemo, mattermost, tekton-pipelines-fips, flux-source-controller-fips, harbor-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: argo-events-fips, caddy-fips, external-dns, kyverno-notation-aws-fips, crossplane-provider-aws-kafka, crossplane-provider-aws-organizations-fips, etcd, knative-kafka-broker-fips, cilium, crossplane-provider-azure-search, buildkitd, datadog-agent-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: argo-events-fips, caddy-fips, external-dns, kyverno-notation-aws-fips, crossplane-provider-aws-kafka, crossplane-provider-aws-organizations-fips, etcd, knative-kafka-broker-fips, cilium, crossplane-provider-azure-search, buildkitd, datadog-agent-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: aactl, crossplane-provider-aws-iam, crossplane-provider-aws-lambda, pulumi, falcoctl, k3s, act, crossplane-provider-aws-ec2, eksctl, gh, kine, prometheus, crossplane-provider-aws-sns, opentofu, crossplane-provider-aws-dynamodb, cilium, crossplane-provider-azure-sql,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: aactl, docker-machine-driver-harvester, pulumi, falcoctl, k3s, act, eksctl, gh, kine, prometheus, opentofu, cilium, crossplane-provider-azure-sql, zarf, openbao, crossplane-provider-azure-storage, slsa-verifier, terragrunt, datadog-agent, helm, buildkitd,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: aactl, docker-machine-driver-harvester, pulumi, k3s, act, prometheus, kine, opentofu, cilium, zarf, openbao, terragrunt, helm, telegraf, argocd-image-updater, kubescape, minio, external-secrets-operator, k9s, fscrypt, mattermost, gitlab-kas, step, rancher, step-issue...

MAL-2026-6520 Malicious code in rollup-plugin-polyfill-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b21017bf70f3f7909beadfff916971711ef9d236ab81797b3bb53569034fa67c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6519 Malicious code in react-icon-svgs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff5b9a03e2018642801f0a9d253297cf1eb8ce39a8af4152f31bcd045e4768d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6518 Malicious code in ai-node-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae845382ff29756db63bf611b9b6bdbd49c44be3bcc8b283512e6590182ac48b ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator string-array rotation, 0x-prefixed identifiers, base64...

Malicious code in ai-node-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae845382ff29756db63bf611b9b6bdbd49c44be3bcc8b283512e6590182ac48b ai-node-relay ships dist/index.js as its npm main entry, processed with javascript-obfuscator string-array rotation, 0x-prefixed identifiers, base64...

Malicious code in ai-node-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dcf100385d43e4bb2e48489a99d1fc2d4f919953963fa0339966bd5270f61b3 All published JavaScript in dist/ index.js, client.js, server.js, react.js, and sibling chunks is heavily obfuscated using javascript-obfuscator...

CVE-2026-11702

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess...

CVE-2026-11625

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced...