Open Source Vulnerabilities

minio-operator, minio-operator, minio-operator, minio-operator

Security fix for GHSA-mh63-6h87-95cp applied in: minio-operator 6.0.4-r1, minio-operator 6.0.4-r2, minio-operator 6.0.4-r3, minio-operator 6.0.4-r4

minio-operator, minio-operator, minio-operator, minio-operator, minio-operator, minio-operator

golang-jwt is a Go implementation of JSON Web Tokens

rancher-fleet-agent

containerd is an open-source container runtime

rancher-fleet-agent

containerd is an open-source container runtime

spark-sc213-jdk17-py312, apache-hive, apache-nifi, apache-zookeeper

JLine is a Java library for handling console input

spark-sc213-jdk17-py312, apache-hive, apache-nifi, apache-zookeeper

JLine is a Java library for handling console input

gradle, sonarqube, apache-hive, gradle, apache-hive, wso2is, apache-hive, wso2am, wso2is, keycloak, activemq, apache-zookeeper

TypeDeserializerBase

gradle, sonarqube, apache-hive, gradle, apache-hive, wso2is, apache-hive, wso2am, wso2is, keycloak, apache-zookeeper

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

sonarqube, apache-hive, gradle, apache-hive, wso2is, apache-hive, wso2am, wso2is, keycloak, activemq, apache-zookeeper

NumberInput

gradle, sonarqube, apache-hive, gradle, apache-hive, wso2is, apache-hive, wso2am, wso2is, keycloak, activemq, apache-zookeeper

UTF8DataInputJsonParser

next, @rootio/next

GHSA-vcvr-r3jv-pc5j in next - Patched by Root

flux-2.10, flux-2.10

flux-2.10, flux-2.10

flux-2.10, flux-2.10

suseconnect-ng, suseconnect-ng, suseconnect-ng, suseconnect-ng, suseconnect-ng, suseconnect-ng

Security update for suseconnect-ng

github.com/envoyproxy/gateway, rootio-github.com/envoyproxy/gateway

CVE-2026-53714 in github.com/envoyproxy/gateway - Patched by Root

github.com/envoyproxy/gateway, rootio-github.com/envoyproxy/gateway

CVE-2026-53713 in github.com/envoyproxy/gateway - Patched by Root

grafana-rollout-operator, opentofu, terraform

OpenTelemetry-Go is the Go implementation of OpenTelemetry

grafana-rollout-operator, opentofu, terraform

OpenTelemetry-Go is the Go implementation of OpenTelemetry

clickhouse

clickhouse, clickhouse

cryptography

CVE-2026-34073 in cryptography - Patched by Root

cryptography

CVE-2026-39892 in cryptography - Patched by Root

undici, @rootio/undici

CVE-2026-1525 in undici - Patched by Root

wildfly, wildfly, apache-nifi-registry

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition

vitess-24, vitess-24

vitess-24, vitess-24

gradle, gradle, wso2is, wso2is, wso2is, elasticsearch, elasticsearch, elasticsearch, elasticsearch

jsoup through 1

sonarqube, elasticsearch, elasticsearch, elasticsearch, elasticsearch

vulnerability occurs when a client sends HTTP/1

harbor-fips, consul

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

runc

runc through 1

kafka, solr, solr

Security fix for GHSA-6hg6-v5c8-fphq applied in: kafka 4.2.0-r2, solr 9.9.0-r0, solr 9.10.1-r2

solr, solr, solr

Security fix for GHSA-w35j-pv5h-q9q9 applied in: solr 10.0.0-r0, solr 9.9.0-r0, solr 9.10.1-r2

sonarqube, kafka, solr, solr

Security fix for GHSA-h383-gmxw-35v2 applied in: sonarqube 26.4.0.121862-r0, kafka 4.2.0-r2, solr 9.9.0-r0, solr 9.10.1-r2

kafka, solr, solr, solr

Security fix for GHSA-3pxv-7cmr-fjr4 applied in: kafka 4.2.0-r2, solr 10.0.0-r0, solr 9.9.0-r0, solr 9.10.1-r2

kafka, solr, solr

Security fix for GHSA-445c-vh5m-36rj applied in: kafka 4.2.0-r2, solr 9.9.0-r0, solr 9.10.1-r2

kafka, solr, solr

Security fix for GHSA-355h-qmc2-wpwf applied in: kafka 4.2.0-r2, solr 10.0.0-r2, solr 9.10.1-r2

solr

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling

solr

integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2

wso2is, solr, solr, solr

Apache Log4j's JsonTemplateLayout https://logging

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, wso2is, wso2is, kafka, solr, solr, wso2am, wso2is, solr

Apache Log4j Core's XmlLayout https://logging

sonarqube, spark-sc213-jdk17-py312, kafka, solr, solr, solr

Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, kafka, solr, wso2am, solr

Apache Log4j Core's Rfc5424Layout https://logging

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, wso2is, kafka, solr, wso2am, wso2is, solr

fix for CVE-2025-68161 https://logging

apache-zookeeper, solr, solr, solr, solr

Security fix for GHSA-x4gw-5cx5-pgmh applied in: apache-zookeeper 3.8.6-r2, solr 10.0.0-r3, solr 9.10.1-r3, solr 9.10.1-r4, solr 9.10.1-r5

apache-zookeeper, solr, solr, solr, solr

Security fix for GHSA-w573-9ffj-6ff9 applied in: apache-zookeeper 3.8.6-r2, solr 10.0.0-r3, solr 9.10.1-r3, solr 9.10.1-r4, solr 9.10.1-r5

solr, solr, solr, solr

Security fix for GHSA-rwm7-x88c-3g2p applied in: solr 10.0.0-r2, solr 9.10.1-r2, solr 9.10.1-r4, solr 9.10.1-r5

solr, solr

Security fix for GHSA-c653-97m9-rcg9 applied in: solr 10.0.0-r3, solr 9.10.1-r5

apache-zookeeper, solr, solr, solr, solr

Security fix for GHSA-3qp7-7mw8-wx86 applied in: apache-zookeeper 3.8.6-r2, solr 10.0.0-r3, solr 9.10.1-r3, solr 9.10.1-r4, solr 9.10.1-r5

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, elasticsearch, elasticsearch, strimzi-kafka-operator, solr, solr

Netty is a network application framework for development of protocol servers and clients