Open Source Vulnerabilities

solr

Security fix for GHSA-qr3p-2xj2-q7hq applied in: solr 9.9.0-r0

apache-hive, apache-hive

yawkat LZ4 Java provides LZ4 compression for Java

solr

Security fix for GHSA-vc2w-4v3p-2mqw applied in: solr 9.9.0-r0

apache-hive, apache-hive

Out-of-bounds memory operations in org

solr

"create core" API of Apache Solr 8

apache-hive, apache-hive

security issue was found in Netplex Json-smart 2

solr

Deployments of Apache Solr 5

solr

Security fix for GHSA-7p63-w6x9-6gr7 applied in: solr 9.9.0-r0

solr

In Eclipse Jersey versions 2

sonarqube, wso2is, wso2is, wso2is

Hazelcast is a unified real-time data platform combining stream processing with a fast data store

sonarqube, wso2is, wso2is, wso2is

Hazelcast is a unified real-time data platform combining stream processing with a fast data store

undici, @rootio/undici

CVE-2026-15157 in undici - Patched by Root

opensearch-dashboards-2-alerting-dashboards-plugin

sonarqube, spark-sc213-jdk17-py312

yawkat LZ4 Java provides LZ4 compression for Java

sonarqube, spark-sc213-jdk17-py312

yawkat LZ4 Java provides LZ4 compression for Java

nfs-subdir-external-provisioner

httpTokenCacheKey uses path

nfs-subdir-external-provisioner

Applications and libraries which misuse connection

openbao

tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory

py3-fsspec

fsspec is a specification and Python implementation framework for filesystem interfaces

tekton-chains

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

tekton-chains

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

tekton-chains

sigstore-go is a Go library for Sigstore signing and verification

tekton-chains

sigstore-go is a Go library for Sigstore signing and verification

tekton-chains

Cosign provides code signing and transparency for containers and binaries

tekton-chains

Cosign provides code signing and transparency for containers and binaries

tekton-chains

Rekor is a software supply chain transparency log

tekton-chains

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity

elasticsearch, elasticsearch, elasticsearch, elasticsearch

Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

elasticsearch, elasticsearch, elasticsearch, elasticsearch

CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

dex, opentofu

OpenBao is an open source identity-based secrets management system

temporal-server-fips, temporal-server-fips

package `github

temporal-server, temporal-server, temporal-server, temporal-server, temporal-server-fips

Security fix for GHSA-xpg8-3hhp-p7w8 applied in: temporal-server 1.31.1-r1, temporal-server 1.31.1-r2, temporal-server 1.31.1-r3, temporal-server 1.31.1-r4, temporal-server-fips 1.31.1-r1

temporal-server-fips

Security fix for GHSA-77fj-vx54-gvh7 applied in: temporal-server-fips 1.31.1-r1

temporal-server, temporal-server, temporal-server, temporal-server, temporal-server-fips

Security fix for GHSA-q98v-9f9w-f49q applied in: temporal-server 1.31.1-r1, temporal-server 1.31.1-r2, temporal-server 1.31.1-r3, temporal-server 1.31.1-r4, temporal-server-fips 1.31.1-r1

gradle, gradle, kafka

Directory Traversal vulnerability in the extractFile method of org

kafka

Security fix for GHSA-6fmv-xxpf-w3cw applied in: kafka 4.2.0-r2

argo-cd, argo-cd-fips

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes

argo-cd, argo-cd-fips

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes

temporal-server-fips

Security fix for GHSA-xgrm-4fwx-7qm8 applied in: temporal-server-fips 1.31.1-r1

spark-sc213-jdk17-py312, kafka

JLine is a Java library for handling console input

spark-sc213-jdk17-py312, kafka

JLine is a Java library for handling console input

kafka

vulnerability has been found in luben zstd-jni up to 1

kafka, strimzi-kafka-operator

In Eclipse Jetty, an HTTP URI of this form: /public;/

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, elasticsearch, elasticsearch, strimzi-kafka-operator

Netty is a network application framework for development of protocol servers and clients

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, wildfly, wildfly, elasticsearch, elasticsearch, strimzi-kafka-operator

Netty is a network application framework for development of protocol servers and clients

argo-cd-fips

go-git is an extensible git implementation library written in pure Go

argo-cd-fips

go-git is an extensible git implementation library written in pure Go

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, wildfly, wildfly, strimzi-kafka-operator

Netty is a network application framework for development of protocol servers and clients

argo-cd-fips

go-git is an extensible git implementation library written in pure Go

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, elasticsearch, elasticsearch, strimzi-kafka-operator

Netty is a network application framework for development of protocol servers and clients