155 matches found
CLEANSTART-2026-RE30617 Security fixes in tekton-pipelines-fips 1.14.0-r1
Package tekton-pipelines-fips version 1.14.0-r1 fixes 1 vulnerabilities: CVE-2026-56852...
SUSE CVE-2026-34972
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper...
SUSE CVE-2026-40293
OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground...
CLEANSTART-2026-RW79431 Security fixes in velero-plugin-for-microsoft-azure-fips 1.14.0-r1
Package velero-plugin-for-microsoft-azure-fips version 1.14.0-r1 fixes 9 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-32283, CVE-2026-27140...
CLEANSTART-2026-PM97168 Security fixes in velero-plugin-for-aws 1.14.0-r0
Package velero-plugin-for-aws version 1.14.0-r0 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...
CLEANSTART-2026-XV94237 Security fixes in kubernetes-dashboard-api 1.14.0-r1
Package kubernetes-dashboard-api version 1.14.0-r1 fixes 27 vulnerabilities: ghsa-pc3f-x583-g7j2, CVE-2026-35469, CVE-2026-39820, CVE-2026-25679, CVE-2026-27143...
CLEANSTART-2026-CC37095 Security fixes in grafana-alloy 1.14.0-r1
Package grafana-alloy version 1.14.0-r1 fixes 2 vulnerabilities: CVE-2026-33762, CVE-2026-34165...
CLEANSTART-2026-IY64694 Security fixes in kubernetes-dashboard-api-fips 1.14.0-r1
Package kubernetes-dashboard-api-fips version 1.14.0-r1 fixes 27 vulnerabilities: ghsa-pc3f-x583-g7j2, CVE-2026-35469, CVE-2026-39820, CVE-2026-25679, CVE-2026-27143...
CVE-2026-35152
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...
CVE-2026-35152 Apache Fineract: SQL injection in runreports endpoint
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...
EUVD-2026-44604
A SQL Injection vulnerability exists in Apache Fineract's Report Execution API runreports endpoint in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run...
PT-2026-58893
Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An issue exists in the Report Execution API 'runreports' endpoint where report parameter values are incorporated into the generated SQL query without sufficient validation. This allows an...
GHSA-Q3V2-XJ35-9GRX Umbraco.AI discloses sensitive application configuration values
Impact Under certain configurations, a user with elevated privileges may be able to cause sensitive application configuration values, potentially including secret material such as credentials, to be disclosed. Successful exploitation could expose confidential information and, depending on what th...
PYSEC-2026-920 Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`
Impact When using the Django integration of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their...
PYSEC-2026-542 smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution RCE. The vulnerability stems from the localpythonexecutor.py module, which inadequately restricts Python code...
smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution RCE. The vulnerability stems from the localpythonexecutor.py module, which inadequately restricts Python code...
PT-2026-53611
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution RCE. The vulnerability stems from the local python executor.py module, which inadequately restricts Python co...
OPENSUSE-SU-2026:21143-1 Security update for gleam
This update for gleam fixes the following issues: Changes in gleam: - Update to 1.17.0: Fixed security vulnerabilities: - Restrict custom documentation page path and source values so gleam docs build cannot escape the docs output directory or project root bsc1267396, CVE-2026-32685 - Restrict...
WordPress Transbank Webpay plugin < 1.14.0 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Mateo Contenla & Matías Schiappacasse in WordPress Plugin Transbank Webpay REST versions 1.14.0...