CLEANSTART-2026-MJ21228 Security fixes in harbor 2.13.4-r2

Package harbor version 2.13.4-r2 fixes 7 vulnerabilities: CVE-2025-55198, CVE-2025-55199, CVE-2026-27141, CVE-2025-53547, ghsa-f9f8-9pmf-xv68...

CLEANSTART-2026-US20993 Security fixes in airflow-2 2.10.3-r3

Package airflow-2 version 2.10.3-r3 fixes 22 vulnerabilities: ghsa-27jp-wm6q-gp25, ghsa-5rvq-cxj2-64vf, ghsa-82w8-qh3p-5jfq, ghsa-wqp7-x3pw-xc5r, ghsa-3x9g-8vmp-wqvf...

CLEANSTART-2026-RC48434 Security fixes in mongosh 2.7.0-r1

Package mongosh version 2.7.0-r1 fixes 31 vulnerabilities: CVE-2025-62718, CVE-2026-33937, ghsa-2w6w-674q-4c4q, ghsa-3p68-rc4w-qgx5, CVE-2026-33671...

CLEANSTART-2026-HO81161 Security fixes in apache-nifi 2.8.0-r0

Package apache-nifi version 2.8.0-r0 fixes 4 vulnerabilities: ghsa-x2wq-9x2f-fhj7, ghsa-72hv-8253-57qq, ghsa-6v53-7c9g-w56r, ghsa-2m67-wjpj-xhg9...

CLEANSTART-2026-VY64153 Security fixes in dex 2.44.0-r2

Package dex version 2.44.0-r2 fixes 4 vulnerabilities: CVE-2026-33810, CVE-2026-33814, CVE-2026-29181, CVE-2026-32952...

CLEANSTART-2026-RF73854 Security fixes in keda 2.18.3-r0

Package keda version 2.18.3-r0 fixes 6 vulnerabilities: CVE-2026-26958, CVE-2025-68156, CVE-2026-24051, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr...

CLEANSTART-2026-EP15881 Security fixes in cert-manager-webhook-pdns-fips 2.3.0-r0

Package cert-manager-webhook-pdns-fips version 2.3.0-r0 fixes 17 vulnerabilities: CVE-2022-1996, CVE-2023-45142, CVE-2023-25151, CVE-2022-21698, CVE-2022-30636...

CVE-2026-13330

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...

PT-2026-66514

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description The software is susceptible to JSON Hijacking, a technique where an attacker steals sensitive data from a JSON response. This flaw subsequently leads to Cross-Site Request Forgery CSRF, which...

EUVD-2026-51328

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

CVE-2026-35847

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

PT-2026-66448

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

PT-2026-66445

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

PT-2026-66590

Name of the Vulnerable Software and Affected Versions dnsmgr versions prior to 2.16 Description A local attacker can execute arbitrary code through the ping function located in the CheckUils.php file. Recommendations Update dnsmgr to version 2.16 or later. As a temporary workaround, restrict acce...

CVE-2026-67428

The CVE-2026-67428 entry concerns Flyto2 Core, an automation/AI-agent workflow kernel. Before version 2.26.7, multiple HTTP-emitting modules (including http/requests.py, core.api.http_get, core.api.http_post, graphql.query/mutation, monitor.http_check, communication.slack_send, notification.disco...

CVE-2026-67427

CVE-2026-67427 , affecting Flyto2 Core prior to 2.26.6, enables the workflow engine’s variable resolver to expand ${env.VAR} for any host environment variable without an allowlist or policy check. This bypasses the default capability policy denylist for env.get and env.load_dotenv, enabling a wor...

io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message

A flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service DoS due to memory exhaustion...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.6 security update

Red Hat multicluster engine for Kubernetes v2.9 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score...