ROOT-OS-ALPINE-321-CVE-2026-9547 CVE-2026-9547 in curl - Patched by Root

Root has patched CVE-2026-9547 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-5773 CVE-2026-5773 in curl - Patched by Root

Root has patched CVE-2026-5773 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-12064 CVE-2026-12064 in curl - Patched by Root

Root has patched CVE-2026-12064 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...

Astra Linux – Vulnerability in openexr

OpenEXR provides the specification and reference implementation of the EXR file format, a image storage format for the motion picture industry. From version 3.2.0 up to versions 3.2.7, 3.3.9, and 3.4.9, the DWA lossy decoder used signed 32-bit arithmetic to construct temporary per-component block...

CVE-2026-18510

CVE-2026-18510 affects TranslatePress – Translate Multilingual (WordPress) up to version 3.2.6. Root cause: insufficient input sanitization and output escaping, enabling unauthenticated stored XSS via Comment Content. Attackers can inject arbitrary scripts in pages viewed by users; payloads use W...

GHSA-4MRV-5P47-P938 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

GHSA-4MRV-5P47-P938 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

PYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summary pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An...

CVE-2026-18631 jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization...

EUVD-2026-51824

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in channels/rail/server/railmain.c. When processing a RAIL PDU header, the code subtracts RAILPDUHEADERLENGTH from the peer-controlled orderLength field without firs...

CLEANSTART-2026-TH50881 Security fixes in aws-network-policy-agent-fips 1.3.2-r0

Package aws-network-policy-agent-fips version 1.3.2-r0 fixes 21 vulnerabilities: ghsa-xmrv-pmrh-hhx2, CVE-2026-25681, CVE-2026-42502, CVE-2026-42504, CVE-2026-42505...

CLEANSTART-2026-IU37943 Security fixes in cloud-config-server 4.3.2-r3

Package cloud-config-server version 4.3.2-r3 fixes 38 vulnerabilities: CVE-2026-33870, CVE-2026-33871, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587...

CLEANSTART-2026-CB45837 Security fixes in certificate-transparency-trillian-ctserver 1.3.2-r1

Package certificate-transparency-trillian-ctserver version 1.3.2-r1 fixes 9 vulnerabilities: CVE-2026-25679, CVE-2025-68121, ghsa-p77j-4mvh-x3m3, CVE-2026-27142, CVE-2025-61732...

CLEANSTART-2026-KV57465 Security fixes in airflow-3 3.2.1-r2

Package airflow-3 version 3.2.1-r2 fixes 5 vulnerabilities: CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526...

CLEANSTART-2026-JA64217 Security fixes in argo-cd 3.2.7-r3

Package argo-cd version 3.2.7-r3 fixes 10 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502...

CLEANSTART-2026-JY49884 Security fixes in kibana 9.3.2-r3

Package kibana version 9.3.2-r3 fixes 45 vulnerabilities: ghsa-2w6w-674q-4c4q, ghsa-xq3m-2v4x-88gg, ghsa-pf86-5x62-jrwf, ghsa-6chq-wfr3-2hj9, ghsa-v9p9-hfj2-hcw8...

CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

EUVD-2026-49956

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...

CVE-2026-47768 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...