CLSA-2026-1773101696 TuxCare security update for tough-cookie (6 CVEs)

TuxCare rebuilt tough-cookie to address 6 CVEs. Fixed in 2.2.0-tuxcare.1...

CLSA-2025-1738627240 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18.tuxcare.4...

CVE-2026-69088

Grav CMS 2.0.7–2.0.10 is affected by an arbitrary method invocation vulnerability in blueprint dynamic-field directives. The issue arises because Blueprint::isSafeDynamicCall() only applies its denial list to strings without '::', allowing an account with page-editing rights to insert a directive...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

EUVD-2026-51689

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

CLEANSTART-2026-NF40329 Security fixes in openbao-fips 2.1.1-r10

Package openbao-fips version 2.1.1-r10 fixes 3 vulnerabilities: ghsa-pjcq-xvwq-hhpj, ghsa-j88v-2chj-qfwx, CVE-2026-32952...

CLEANSTART-2026-RB40964 Security fixes in ip-masq-agent 2.9.3-r0

Package ip-masq-agent version 2.9.3-r0 fixes 2 vulnerabilities: ghsa-6wxm-mpqj-6jpf, CVE-2024-45339...

CLEANSTART-2026-WO19208 Security fixes in argo-cd-fips 2.14.20-r0

Package argo-cd-fips version 2.14.20-r0 fixes 10 vulnerabilities: CVE-2025-58187, CVE-2025-58188, CVE-2025-61723, CVE-2025-61725, CVE-2025-47912...

CLEANSTART-2026-NF97709 Security fixes in k8s-sidecar 2.5.4-r0

Package k8s-sidecar version 2.5.4-r0 fixes 2 vulnerabilities: CVE-2026-25645, ghsa-gc5v-m9x4-r6x2...

CLEANSTART-2026-RX52508 Security fixes in consul 2.0.0-r0

Package consul version 2.0.0-r0 fixes 21 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-IF30502 Security fixes in kube-state-metrics 2.10.1-r1

Package kube-state-metrics version 2.10.1-r1 fixes 24 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-HZ82610 Security fixes in openbao-fips 2.2.2-r7

Package openbao-fips version 2.2.2-r7 fixes 10 vulnerabilities: CVE-2026-34986, CVE-2026-39883, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282...

CLEANSTART-2026-BG62788 Security fixes in expat 2.4.3-r0

Package expat version 2.4.3-r0 fixes 8 vulnerabilities: CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824...

CLEANSTART-2026-ZY62272 Security fixes in opensearch-k8s-operator-fips 2.5.1-r4

Package opensearch-k8s-operator-fips version 2.5.1-r4 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...

GHSA-6WCC-39RP-HH9P @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...

CVE-2026-66438

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...

CVE-2026-66438

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...

CVE-2026-10033

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...

CVE-2026-24552

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3...