CLEANSTART-2026-GU39170 Security fixes in amazon-cloudwatch-agent 1.300070.0-r1

Package amazon-cloudwatch-agent version 1.300070.0-r1 fixes 37 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-VJ20703 Security fixes in postgres-operator 1.15.1-r1

Package postgres-operator version 1.15.1-r1 fixes 24 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CLEANSTART-2026-JQ93564 Security fixes in prometheus-pushgateway 1.9.0-r1

Package prometheus-pushgateway version 1.9.0-r1 fixes 24 vulnerabilities: CVE-2026-39835, CVE-2026-39828, CVE-2026-39829, CVE-2026-46597, CVE-2026-39830...

CLEANSTART-2026-CY42435 Security fixes in amazon-cloudwatch-agent 1.300071.0-r1

Package amazon-cloudwatch-agent version 1.300071.0-r1 fixes 36 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-FH07251 Security fixes in vertical-pod-autoscaler 1.7.1-r2

Package vertical-pod-autoscaler version 1.7.1-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-PK78207 Security fixes in tigera-operator 1.40.15-r1

Package tigera-operator version 1.40.15-r1 fixes 1 vulnerabilities: CVE-2026-50163...

CLEANSTART-2026-ER20249 Security fixes in renovate 43.252.8-r2

Package renovate version 43.252.8-r2 fixes 1 vulnerabilities: CVE-2026-59873...

CIS GitLab Benchmark Scanner

CIS GitLab Benchmark Scanner - gitlabcis 背景 2024年4月17日、GitLab™は、セキュリティ向上とGitLab顧客への堅牢化（ハードニング）推奨事項の提供を目的とした、Center for Internet Security®（CIS）GitLab Benchmarkの導入を発表するブログ記事を公開しました。ベンチマークのコピーは、Center for Internet Security®のウェブサイトで公開されており、ダウンロードできます。 "CIS GitLab Benchmarkは、CISとGitLabのField...

ROOT-APP-NPM-CVE-2026-59874 CVE-2026-59874 in tar - Patched by Root

Root has patched CVE-2026-59874 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-24842 CVE-2026-24842 in tar - Patched by Root

Root has patched CVE-2026-24842 in the tar package for Root:npm. Multiple fixed versions available...

Atlassian Jira Confluence - Cross-Site Scripting

Atlassian Jira Confluence before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4, and from version 7.9.0 before version 7.9.2, allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the error messa...

ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval

ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. id: CVE-2017-11512 info...

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization

Zoho ManageEngine OpManager Stable build before 125203 and Released build before 125233 allows Remote Code Execution via the Smart Update Manager SUM servlet. id: CVE-2020-28653 info: name: ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization author: iamnoooob,pdresearch severity:...

Emby < 4.5.0 - Server Server-Side Request Forgery

Emby Server before 4.5.0 allows server-side request forgery SSRF via the Items/RemoteSearch/Image ImageURL parameter. id: CVE-2020-26948 info: name: Emby 4.5.0 - Server Server-Side Request Forgery author: dwisiswant0 severity: critical description: | Emby Server before 4.5.0 allows server-side...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

ESAFENET CDG - Arbitrary File Download

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. id: CVE-2019-9632 info: name: ESAFENET CDG - Arbitrary File Download author: pdteam severity: hi...

MinIO Browser API - Server-Side Request Forgery

MinIO Browser API before version RELEASE.2021-01-30T00-20-58Z contains a server-side request forgery vulnerability. id: CVE-2021-21287 info: name: MinIO Browser API - Server-Side Request Forgery author: pikpikcu severity: high description: MinIO Browser API before version...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials

An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur. id: CVE-2025-32815 info: name: NetMRI 7.6.1 - Authentication Bypass via Hardcoded Credentials author: iamnoooob,pdresearch severity: medium description: | An issue was discovered i...