Open Source Vulnerabilities

kayenta-2026.4

kayenta-2026.4

tekton-chains-fips

Security fix for GHSA-4c4x-jm2x-pf9j applied in: tekton-chains-fips 0.26.0-r1

tekton-chains-fips

Security fix for GHSA-273p-m2cw-6833 applied in: tekton-chains-fips 0.26.0-r1

nextcloud-server-33, nextcloud-server-33

kibana-8.19-bitnami

commercial-gitlab-rails-ee-fips-19.2

commercial-gitlab-rails-ee-fips-19.2

commercial-gitlab-rails-ee-fips-19.2

grafana, helm

Security fix for GHSA-q9hv-hpm4-hj6x applied in: grafana 12.3.4-r0, helm 4.0.5-r1

vitess-23, vitess-23

vitess-23, vitess-23

espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, wildfly, wildfly, keycloak, strimzi-kafka-operator, elasticsearch, elasticsearch

Netty is a network application framework for development of protocol servers and clients

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, wildfly, wildfly, strimzi-kafka-operator, elasticsearch, elasticsearch

Netty is a network application framework for development of protocol servers and clients

opensearch-dashboards-2-fips

libhttp-parser-xs-perl, libhttp-parser-xs-perl, libhttp-parser-xs-perl

starlet, starlet, starlet

starlet, starlet, starlet

starlet, starlet, starlet

starlet, starlet, starlet

elasticsearch, elasticsearch, wso2is, wso2is, wso2is, wso2is, spring-boot, elasticsearch, elasticsearch

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

wso2is, wso2is, spring-boot, elasticsearch, elasticsearch

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5

libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window

commercial-gitlab-rails-ee-fips-19.4

AFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page

tcpflow < 1.7.0 Out-of-Bounds Read via TCP Demultiplexer Payload Length

commercial-gitlab-rails-ee-fips-19.4

commercial-gitlab-rails-ee-fips-19.4

AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes

Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id

OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()

ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections

ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint

ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List

Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service

Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider

Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID

Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses

Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service

starlet, starlet, starlet, starlet, starlet, starlet, starlet

libhttp-parser-xs-perl, libhttp-parser-xs-perl, libhttp-parser-xs-perl, libhttp-parser-xs-perl, libhttp-parser-xs-perl, libhttp-parser-xs-perl, libhttp-parser-xs-perl

starlet, starlet, starlet, starlet, starlet, starlet, starlet

starlet, starlet, starlet, starlet, starlet, starlet, starlet

starlet, starlet, starlet, starlet, starlet, starlet, starlet

gitlab-rails-ce-fips-19.4

gitlab-rails-ce-fips-19.4