CLEANSTART-2026-JS77215 Security fixes in thingsboard-tb-web-ui 4.3.1.1-r0

Package thingsboard-tb-web-ui version 4.3.1.1-r0 fixes 1 vulnerabilities: ghsa-r4q5-vmmm-2653...

CLEANSTART-2026-RP05893 Security fixes in activemq 5.19.3-r0

Package activemq version 5.19.3-r0 fixes 1 vulnerabilities: ghsa-72hv-8253-57qq...

CLEANSTART-2026-HT01746 Security fixes in velero-plugin-for-csi 0.6.3-r1

Package velero-plugin-for-csi version 0.6.3-r1 fixes 2 vulnerabilities: CVE-2025-30204, CVE-2024-51744...

CLEANSTART-2026-MR47325 Security fixes in helm 3.20.2-r0

Package helm version 3.20.2-r0 fixes 1 vulnerabilities: CVE-2026-33186...

Security update for apptainer

This update for apptainer fixes the following issues: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266656. CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid...

fence-agents security update

4.16.0-21.5 - bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939 Resolves: RHEL-193812...

CVE-2026-62343 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issu...

CVE-2026-54249

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67435

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious...

CVE-2026-67431 MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that...

EUVD-2026-50485

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to...

UBUNTU-CVE-2026-65325

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....

openSUSE 16 Security Update : perl-YAML-Syck (openSUSE-SU-2026:21452-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21452-1 advisory. Changes in perl-YAML-Syck: - updated to 1.470.0 1.47 Security - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load...

EUVD-2026-50067

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

EUVD-2026-50028

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management...

SUSE CVE-2026-64538

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6nhmtuchange. fib6nhmtuchange re-fetches idev via in6devgetarg-dev and dereferences idev-cnf.mtu6 without a NULL check. addrconfifdown clears dev-ip6ptr with RCUINITPOINTER after rt6disableip has...

SUSE CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

ROOT-APP-NPM-CVE-2026-65900 CVE-2026-65900 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-65900 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

PT-2026-65622

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.1 Description The bulkDownload handler in httpserver/updown.go fails to call findEffectiveACL or applyCustomAuth when processing ZIP downloads via the ?bulk&file= parameter. This allows an unauthenticated network...