ROOT-APP-NPM-CVE-2026-54270 CVE-2026-54270 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-54270 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

SUSE CVE-2026-48794

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. In versions 4.36.0 through 4.39.19, due to lack of canonicalization of domains in very specific edge cases, an access control rule may b...

SUSE CVE-2026-49821

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched...

ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-49978 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-44185 CVE-2026-44185 in rootio-apache2 - Patched by Root

Root has patched CVE-2026-44185 in the rootio-apache2 package for Root:Debian:13. Multiple fixed versions available...

CLEANSTART-2026-QM89803 Security fixes in victoriametrics-operator-fips 0.65.0-r1

Package victoriametrics-operator-fips version 0.65.0-r1 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-AB32653 Security fixes in istio 1.28.5-r0

Package istio version 1.28.5-r0 fixes 2 vulnerabilities: CVE-2026-24051, ghsa-9h8m-3fm2-qjrq...

CLEANSTART-2026-AR53211 Security fixes in kubernetes-dns-node-cache 1.24.1-r0

Package kubernetes-dns-node-cache version 1.24.1-r0 fixes 2 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jaeger: jaeger-2.20.0-0.7.hum1 aarch64, x8664 jaeger-2.20.0-0.7.hum1.src src Security Fixes: jaeger: CVE-2026-67214...

GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

ROOT-OS-DEBIAN-13-CVE-2026-34980 CVE-2026-34980 in rootio-cups - Patched by Root

Root has patched CVE-2026-34980 in the rootio-cups package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2024-52616 CVE-2024-52616 in rootio-avahi - Patched by Root

Root has patched CVE-2024-52616 in the rootio-avahi package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-59529 CVE-2025-59529 in rootio-avahi - Patched by Root

Root has patched CVE-2025-59529 in the rootio-avahi package for Root:Debian:13. Multiple fixed versions available...

Check Point Gaia Operating System (sk185153)

The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk185153 advisory. - A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with roo...

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...

CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

Important: Red Hat Security Advisory: pipewire security update

An update for pipewire is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2026-67173

Pivotick exposes a URI handling flaw in graph rendering: node imagePath values derived from graph data are not validated for their URL schemes before being assigned to SVG image resources. An attacker could supply crafted graph data to cause an image path to point to a malicious URI, and when a v...

Security update for the Linux Kernel (Live Patch 26 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.112 fixes various security issues: The following security issues were fixed: CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN bsc1266970. CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due...

The CTDB protocol has bounds checking issues

== Summary: CTDB fails to do integrity checking of received packets. This includes failure to check field lengths against packet lengths when unmarshalling packets. Description CTDB fails to do a number of integrity checks on received packets. This includes: checking of field lengths against pack...