Open Source Vulnerabilities

kayenta-fips-2026.4

kayenta-fips-2026.4

kayenta-fips-2026.4

kayenta-fips-2026.4

kayenta-fips-2026.4

kayenta-fips-2026.4

kayenta-fips-2026.4

kayenta-fips-2026.4

kayenta-fips-2026.4

kayenta-fips-2026.4

nextcloud-server-34

nodejs22

Security update for nodejs22

tar

TuxCare security update for tar (2 CVEs)

wazuh-dashboard-index-management-dashboards-plugin-fips

sentry-cli

sentry-cli

sentry-cli

sentry-cli

gitlab-rails-ce-19.5

gitlab-rails-ce-19.5

gitlab-rails-ce-19.5

gitlab-rails-ce-19.5

commercial-gitlab-rails-ee-fips-19.1

commercial-gitlab-rails-ee-fips-19.1

commercial-gitlab-rails-ee-fips-19.1

wazuh-dashboard-dashboards-reporting-fips

wazuh-dashboard-dashboards-reporting-fips

gitlab-rails-ce-19.1

gitlab-rails-ce-19.1

gitlab-rails-ce-19.1

wazuh-dashboard-fips

fnm

fnm

verus, verus

verus, verus

verus, verus

verus, verus

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Reader

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

When Conn

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, opentelemetry-collector-contrib, velero, yunikorn-k8shim, rabbitmq-messaging-topology-operator, temporal-server-fips, vt-cli, thanos, velero-plugin-for-aws, helm, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, sealed-secrets, logstash-exporter-fips

On Unix platforms, when listing the contents of a directory using File

go-fips-1.26, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

tar

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

rclone, dex, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rclone, rclone, rclone, haproxy-ingress, haproxy-ingress, velero, velero, velero, renovate, prometheus-alertmanager, argo-cd-fips, argo-cd-fips, argo-cd-fips, argo-cd-fips, temporal-server-fips, prometheus, dex, cortex, runc, velero, velero, velero, velero, thanos, dynatrace-operator, dynatrace-operator, dynatrace-operator, dynatrace-operator, etcd, velero-plugin-for-aws, velero-fips, velero-fips, velero-fips, vault-k8s, trust-manager, vault-k8s, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, opentelemetry-collector-contrib, go-fips-1.26, velero, yunikorn-k8shim, rabbitmq-messaging-topology-operator, temporal-server-fips, vt-cli, thanos, velero-plugin-for-aws, helm, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, sealed-secrets, logstash-exporter-fips

Actions which insert URLs into the content attribute of HTML meta tags are not escaped

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method

argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", "

dex, opa-fips, prometheus-redis-exporter-fips, prometheus-redis-exporter-fips, rclone, velero, renovate, prometheus-alertmanager, ollama-fips, ollama-fips, temporal-server, temporal-server, argo-rollouts-fips, weaviate-fips, weaviate-fips, kube-state-metrics-fips, runc, etcd, thanos, thanos, etcd, velero-plugin-for-aws, opentelemetry-collector, helm, logstash-exporter-fips, argo-cd-fips, argo-cd-fips, kube-vip-fips, kube-vip-fips, logstash-exporter-fips

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

dex, opa-fips, prometheus-redis-exporter-fips, prometheus-redis-exporter-fips, rclone, velero, renovate, prometheus-alertmanager, ollama-fips, ollama-fips, temporal-server, temporal-server, argo-rollouts-fips, weaviate-fips, weaviate-fips, kube-state-metrics-fips, runc, etcd, thanos, thanos, etcd, velero-plugin-for-aws, opentelemetry-collector, velero-plugin-for-csi, cosign, helm, logstash-exporter-fips, argo-cd-fips, argo-cd-fips, kube-vip-fips, kube-vip-fips, logstash-exporter-fips

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures