Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.1-0.5.hum1 aarch64, x8664 grafana13.1-13.1.1-0.5.hum1.src src Security Fixes: grafana13.1: CVE-2026-67313 CVE-2026-67314 CVE-2026-67315 CVE-2026-67316 CVE-2026-67317...

UBUNTU-CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

EUVD-2026-52031

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.1-0.4.hum1 aarch64, x8664 grafana13.1-13.1.1-0.4.hum1.src src Security Fixes: grafana13.1: CVE-2026-18446...

CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

CVE-2026-65841

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-52856

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

CVE-2026-12721

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-14522

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

EUVD-2026-51138

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

CVE-2026-14519 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CLEANSTART-2026-AH11699 Security fixes in ollama 0.20.3-r1

Package ollama version 0.20.3-r1 fixes 13 vulnerabilities: CVE-2026-33811, CVE-2026-33812, CVE-2026-33813, CVE-2026-33814, CVE-2026-39817...

CLEANSTART-2026-SZ84105 Security fixes in argo-rollouts-fips 1.9.0-r0

Package argo-rollouts-fips version 1.9.0-r0 fixes 13 vulnerabilities: ghsa-93mq-9ffx-83m2, ghsa-cfpf-hrx2-8rv6, ghsa-gxhx-2686-5h9g, ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-YS85875 Security fixes in policy-controller 0.12.1-r1

Package policy-controller version 0.12.1-r1 fixes 13 vulnerabilities: CVE-2025-8556, CVE-2026-1229, CVE-2025-15558, CVE-2025-46569, CVE-2026-22703...

CLEANSTART-2026-YP95633 Security fixes in grafana 12.2.10-r1

Package grafana version 12.2.10-r1 fixes 13 vulnerabilities: ghsa-p4r4-xvrq-gvmc, ghsa-ffqx-q65f-36jf, CVE-2026-21728, CVE-2026-28377, ghsa-wg65-39gg-5wfj...

CLEANSTART-2026-EL73954 Security fixes in argo-cd 3.3.5-r1

Package argo-cd version 3.3.5-r1 fixes 13 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-SU06112 Security fixes in keycloak 26.6.3-r3

Package keycloak version 26.6.3-r3 fixes 13 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516...

CLEANSTART-2026-RM35950 Security fixes in istio-fips 1.27.8-r3

Package istio-fips version 1.27.8-r3 fixes 13 vulnerabilities: CVE-2026-27140, CVE-2026-32283, CVE-2026-32280, CVE-2026-32281, ghsa-78h2-9frx-2jm8...

CLEANSTART-2026-VK07836 Security fixes in terragrunt-fips 0.94.0-r3

Package terragrunt-fips version 0.94.0-r3 fixes 13 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32283...