CLEANSTART-2026-SY59629 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree

Security vulnerability affects the langfuse-worker package. PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree...

CLEANSTART-2026-JG00673 uuid before 14

Security vulnerability affects the langfuse-worker package. uuid before 14...

CLEANSTART-2026-DF16083 Security fix for CVE-2026-45820 applied in: langfuse-worker 3.225.9-r3

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ML15245 deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects

Security vulnerability affects the langfuse-worker package. deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects...

CLEANSTART-2026-BZ86310 Security fix for ghsa-wq5f-xc86-pv6w applied in: langfuse-worker 3.225.9-r5

Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZG01610 uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs

Security vulnerability affects the langfuse-worker package. uuid is for the creation of RFC9562 formerly RFC4122 UUIDs...

CLEANSTART-2026-CD82080 undici's cache interceptor mishandles malformed Cache-Control private directives

Security vulnerability affects the langfuse-worker package. undici's cache interceptor mishandles malformed Cache-Control private directives...

CLEANSTART-2026-VU21760 source-map-js through 1

Security vulnerability affects the langfuse-worker package. source-map-js through 1...

PT-2026-107989

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

Exploit for CVE-2026-102253

CVE-2026-102253-POC DOS infinite-loop Vulnerability POC Su...

CVE-2026-107211

The Excelize Go language library (versions 2.8.1 to 2.11.0 ) contains a vulnerability where the extractPivotTableFields function fails to perform bounds checks when indexing the pivot-cache field-name slice. The issue arises because the library trusts the dataField fld attribute from getPivotCach...

GO-2026-6489 Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase

Pocketbase: Unhandled panic in worker goroutines in github.com/pocketbase/pocketbase...

CVE-2026-104848

A flaw was found in tinypool. When an attacker is able to modify base JavaScript object properties prototype pollution, tinypool inadvertently copies these inherited configuration values into newly spawned worker threads. An attacker can exploit this behavior by injecting malicious startup...

cpra

Continuous Pulse and Recovery Agent Checks services, sends alerts, and runs the recovery actions you configure. CPRa is a self-hosted monitoring and recovery agent written in Go. It runs health checks against your services on a schedule, opens and closes incidents against configurable thresholds,...

CVE-2026-103870

A path traversal flaw exists in pulp-rpm during the distribution tree publication process. The software uses addon and variant IDs from .treeinfo files as directory names without sufficient validation. An attacker with permissions to sync or upload a distribution tree can force the publish task t...

CVE-2026-103870 Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...

CVE-2026-103870 Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...

CVE-2026-103868

A flaw in pulp-container allows for the reuse of registry credentials across different remotes within the same worker during authentication to an upstream registry. Specifically, Basic and bearer credentials from one remote are incorrectly reused for subsequent downloads. An attacker who can sync...

CVE-2026-103870

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...

PT-2026-107395

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...