CLEANSTART-2026-DP50592 Security fixes in step-issuer 0.10.2-r2

Package step-issuer version 0.10.2-r2 fixes 3 vulnerabilities: CVE-2026-42507, CVE-2026-42504, CVE-2026-27145...

CLEANSTART-2026-DE61610 Security fixes in step-issuer-fips 0.9.9-r2

Package step-issuer-fips version 0.9.9-r2 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-NH70338 Security fixes in step 0.29.0-r0

Package step version 0.29.0-r0 fixes 1 vulnerabilities: CVE-2025-61729...

CLEANSTART-2026-KO29814 Security fixes in step-issuer 0.9.10-r0

Package step-issuer version 0.9.10-r0 fixes 1 vulnerabilities: CVE-2025-61729...

CLEANSTART-2026-YW87628 Security fixes in step 0.28.7-r2

Package step version 0.28.7-r2 fixes 6 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505, CVE-2025-66406...

CLEANSTART-2026-ID94434 Security fixes in step-issuer 0.10.2-r3

Package step-issuer version 0.10.2-r3 fixes 4 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-HH86881 Security fixes in step-ca-fips 0.29.0-r1

Package step-ca-fips version 0.29.0-r1 fixes 2 vulnerabilities: CVE-2026-26958, ghsa-fw7p-63qq-7hpr...

CLEANSTART-2026-OQ54601 Security fixes in step-cli 0.29.0-r0

Package step-cli version 0.29.0-r0 fixes 1 vulnerabilities: CVE-2025-61729...

CLEANSTART-2026-XL70757 Security fixes in step 0.29.0-r1

Package step version 0.29.0-r1 fixes 2 vulnerabilities: CVE-2026-42505, CVE-2026-39822...

CLEANSTART-2026-TB76607 Security fixes in step 0.28.7-r0

Package step version 0.28.7-r0 fixes 1 vulnerabilities: CVE-2025-62820...

CLEANSTART-2026-XA28320 Security fixes in step 0.30.2-r2

Package step version 0.30.2-r2 fixes 2 vulnerabilities: CVE-2026-34986, CVE-2026-34986...

CLEANSTART-2026-XV94605 Security fixes in step-issuer 0.12.0-r0

Package step-issuer version 0.12.0-r0 fixes 4 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-LA03825 Security fixes in step-issuer 0.9.11-r1

Package step-issuer version 0.9.11-r1 fixes 60 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-69725...

CLEANSTART-2026-GI36891 Security fixes in step-issuer 0.9.9-r0

Package step-issuer version 0.9.9-r0 fixes 1 vulnerabilities: CVE-2025-62820...

CLEANSTART-2026-UR44491 Security fixes in step-issuer 0.10.1-r0

Package step-issuer version 0.10.1-r0 fixes 4 vulnerabilities: CVE-2026-30836, CVE-2026-33186, ghsa-q4r8-xm5f-56gw, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-YB56144 Security fixes in step-issuer-fips 0.9.9-r3

Package step-issuer-fips version 0.9.9-r3 fixes 2 vulnerabilities: ghsa-h8cp-697h-8c8p, ghsa-j7c9-79x7-8hpr...

CVE-2026-64555

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for ARM64 architecture, specifically affecting nested virtualization. The kvmhyphandlemops function, responsible for handling certain virtualization operations, incorrectly restored the SPSREL2 register. This occurred because...

GHSA-VX7X-VCC2-C44G datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

Summary datamodel-code-generator's anti-SSRF guard validates the resolved IP of a fetch target once and then lets httpx perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at...

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

Reauthentication Bypass via One-Time Access Token Login Summary A weaker authentication method OTA token or signup token is accepted as passkey step-up proof, yielding unauthorized renewable 30-day OIDC refresh tokens for clients explicitly configured with RequiresReauthentication: true. The POST...

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...