The security issue identified as GO-2026-5932 affects multiple software packages including velero, gitea, and minio. The vulnerability has been addressed in specific later releases of these packages. Users should upgrade to the fixed versions to mitigate the issue.
A low severity security vulnerability (CVE-2026-81870) affects the keda package, specifically the OpenTelemetry-Go implementation. The issue impacts versions prior to 2.19.0-r4, 2.19.0-r5, and 2.20.2-r5. A patch is available in these fixed versions. No known exploits are reported in the wild.
CVE-2026-116587 is a high-severity vulnerability affecting multiple versions of Velero that use the Go JOSE library, which implements Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. The vulnerability impacts availability but does not affect confidentiality or integrity. Fixed versions are available for all affected releases.
CVE-2026-116586 is a medium severity vulnerability affecting multiple versions of Velero that use Go JOSE, an implementation of the Javascript Object Signing and Encryption standards. The flaw impacts versions prior to the fixed releases listed. A patch is available to address the issue.
CVE-2026-116585 is a medium severity vulnerability affecting multiple versions of Velero that use the Go JOSE library, which implements Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. The vulnerability impacts several Velero package versions prior to fixed releases. A patch is available in the specified fixed versions.
CVE-2026-111497 is a critical buffer overflow vulnerability in the Brotli decoder component used by Gitea. It affects multiple package versions prior to 1.27.3-r4, 2.11.0-r3, 26.6.4-r8, and 2.20.2-r5. The flaw allows remote attackers to execute arbitrary code or cause denial of service without requiring user interaction. A fix is available in the specified patched versions.
CVE-2026-41889 is a critical security vulnerability in the keda package, specifically affecting pgx, a PostgreSQL driver and toolkit for Go. Versions prior to 2.20.2-r5 are vulnerable. The flaw has a high CVSS score of 9.8, indicating it allows remote, unauthenticated attackers to cause complete confidentiality, integrity, and availability compromise. A fix is available in version 2.20.2-r5.
CVE-2026-116591 is a high-severity vulnerability affecting multiple versions of Gitea related to its compress package, which provides various compression algorithms. The flaw impacts versions prior to 1.27.3-r3, 1.29.7-r6, and 2.20.2-r6. A fix is available in these versions. The vulnerability has a CVSS 4.0 base score of 8.7, indicating significant potential impact if exploited.
A security vulnerability in argo-workflows allows passive network observers to de-anonymize handshakes that use Encrypted Client Hello (ECH). This occurs because pre-shared key identities are disclosed in the unencrypted client hello message. The issue affects versions prior to 4.1.6-r1 and has a medium severity rating with a CVSS score of 5.3.
A medium severity security vulnerability (CVE-2025-61730) affects the argo-workflows package versions prior to 4.1.6-r1. The issue relates to TLS 1 handling. A fix is available in version 4.1.6-r1.
A security vulnerability in the argo-workflows package affects versions prior to 4.1.6-r1. The issue arises from the archive/zip component using a super-linear file name indexing algorithm that is triggered the first time a file in an archive is opened. This flaw can cause a denial of service by impacting availability. A fix is available in version 4.1.6-r1.
A security vulnerability in argo-workflows prior to version 4.1.6-r1 allows an excluded subdomain constraint in a certificate chain to fail to restrict the usage of wildcard Subject Alternative Names (SANs) in the leaf certificate. This flaw could allow certificates with wildcard SANs to be accepted despite subdomain constraints intended to limit their scope.
A high-severity security vulnerability (CVE-2026-39822) affects the argo-workflows package on Unix systems. The flaw involves opening a file in the operating system, potentially leading to complete compromise of confidentiality, integrity, and availability. Versions prior to 4.1.6-r1 are affected. A fix is available in version 4.1.6-r1.
A security vulnerability in Keycloak affects versions prior to 26.6.4-r6. The issue involves the MariaDB Connector/J used for Java applications connecting to MariaDB and MySQL databases. The vulnerability has a medium severity with a CVSS score of 5.9 and impacts the integrity of the system without affecting confidentiality or availability. A patch is available in version 26.6.4-r6 to address this issue.
A low-severity security vulnerability affects the Keycloak package due to the use of MariaDB Connector/J, which connects Java applications to MariaDB and MySQL databases. The vulnerability impacts versions of Keycloak prior to 26.6.4-r6. The flaw does not affect confidentiality or integrity but may cause a limited availability impact. A patch is available in version 26.6.4-r6.
A vulnerability in the argo-workflows package's net/url component allows an unlimited number of query parameters in a URL query, which can lead to denial of service conditions. This issue affects versions prior to 4.1.6-r1. The vulnerability has a high severity score due to its potential to cause availability impact. A fix is available in version 4.1.6-r1.
A security vulnerability exists in Keycloak due to the use of pgjdbc, the PostgreSQL JDBC Driver, versions 42. The affected Keycloak versions are prior to 26.6.4-r8. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity issue with network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. A fix is available in Keycloak version 26.6.4-r8.
A security vulnerability affects Keycloak due to an issue in pgjdbc, the PostgreSQL JDBC Driver, specifically in versions prior to 26.6.4-r8. The vulnerability has a CVSS score of 5.9, indicating a medium severity. It allows an attacker to cause a confidentiality impact without requiring privileges or user interaction. A patch is available in version 26.6.4-r8.
CVE-2026-18040 is a medium severity vulnerability affecting Apache NiFi due to an issue in Bouncy Castle for Java versions before 1. The flaw impacts multiple packages and has been fixed in Apache NiFi versions 2.11.0-r3 and 26.6.4-r8. No known exploits are reported in the wild.
CVE-2026-97873 is a medium severity vulnerability affecting Apache NiFi due to an issue in Bouncy Castle for Java versions before 1. The vulnerability impacts multiple packages and is fixed in Apache NiFi versions 2.11.0-r3 and 26.6.4-r8. No known exploits are reported in the wild.