CLEANSTART-2026-XE28379 Security fixes in rabbitmq-messaging-topology-operator 1.19.3-r0

Package rabbitmq-messaging-topology-operator version 1.19.3-r0 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-JR45189 Security fixes in ztunnel-fips 1.27.5-r1

Package ztunnel-fips version 1.27.5-r1 fixes 3 vulnerabilities: ghsa-xwfj-jgwm-7wp5, ghsa-2gh3-rmm4-6rq5, ghsa-rhfx-m35p-ff5j...

CLEANSTART-2026-IL70948 Security fixes in argo-rollouts 1.9.0-r0

Package argo-rollouts version 1.9.0-r0 fixes 13 vulnerabilities: ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3, ghsa-93mq-9ffx-83m2, ghsa-pc3f-x583-g7j2, ghsa-cfpf-hrx2-8rv6...

CLEANSTART-2026-TB71092 Security fixes in kubernetes-csi-external-resizer-fips 2.1.0-r1

Package kubernetes-csi-external-resizer-fips version 2.1.0-r1 fixes 48 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-BH92291 Security fixes in prometheus-mysqld-exporter 0.15.0-r4

Package prometheus-mysqld-exporter version 0.15.0-r4 fixes 3 vulnerabilities: CVE-2026-42507, CVE-2026-42504, CVE-2026-27145...

CLEANSTART-2026-EZ64773 Security fixes in python3 3.12.12-r0

Package python3 version 3.12.12-r0 fixes 3 vulnerabilities: CVE-2026-1703, CVE-2025-24049, CVE-2025-59375...

CLEANSTART-2026-TH89970 Security fixes in openjdk8 8.242.08-r0

Package openjdk8 version 8.242.08-r0 fixes 7 vulnerabilities: CVE-2020-2583, CVE-2020-2590, CVE-2020-2593, CVE-2020-2601, CVE-2020-2604...

CLEANSTART-2026-QK79485 Security fixes in docker 25.0.2-r0

Package docker version 25.0.2-r0 fixes 5 vulnerabilities: CVE-2024-23651, CVE-2024-23652, CVE-2024-23653, CVE-2024-23650, CVE-2024-24557...

SUSE-SU-2026:3418-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...

Security update for apptainer

This update for apptainer fixes the following issues: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266656. CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid...

SUSE-SU-2026:3417-1 Security update for apptainer

This update for apptainer fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266656. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invali...

Security update for prometheus-ha_cluster_exporter

This update for prometheus-haclusterexporter fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266552. Other updates and bugfixes: Release 1.4.2: Use proper obs time form...

Important: Red Hat Security Advisory: fence-agents security update

An update for fence-agents is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

ALPINE-CVE-2026-58040

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

ALPINE-CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-59327

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-15153

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

UBUNTU-CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-13330

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...