A high-severity security vulnerability (CVE-2026-97689) affects the miniforge3 package due to an issue in urllib3, a Python HTTP client library. The vulnerability impacts versions of miniforge3 prior to 25.11.0.1-r6 and 26.3.2.3-r6. A fix is available in these versions. No known exploits in the wild have been reported.
A security vulnerability has been identified in the miniforge3 package affecting the urllib3 HTTP client library for Python. The flaw impacts versions prior to 25.11.0.1-r6 and 26.3.2.3-r6. It has a medium severity rating with a CVSS score of 6.9. A patch is available in versions 25.11.0.1-r6 and 26.3.2.3-r6.
A high-severity security vulnerability (CVE-2026-97687) affects the miniforge3 package, specifically the urllib3 HTTP client library for Python. The flaw impacts versions prior to 25.11.0.1-r6 and 26.3.2.3-r6. A fix has been released in these versions to address the issue.
A high-severity security vulnerability affecting the miniforge3 package was identified and fixed in version 25.11.0.1-r6. The vulnerability does not impact confidentiality or integrity but causes a significant availability impact. The issue is resolved in the fixed release 25.11.0.1-r6.
A high-severity security vulnerability (CVE-2026-57585) affects the miniforge3 package, specifically in the MessagePack serializer implementation for Python msgpack. The vulnerability impacts versions prior to 25.11.0.1-r6 and can cause a denial of service (availability impact) without compromising confidentiality or integrity. A patch is available in version 25.11.0.1-r6.
A high-severity security vulnerability (CVE-2026-114613) affects the miniforge3 package, specifically in the MessagePack serializer implementation for Python msgpack. The vulnerability has no impact on confidentiality or integrity but causes high impact on availability. Fixed versions have been released to address this issue.
CVE-2026-113602 is a medium severity security vulnerability affecting the elasticsearch package due to an issue in the json-smart library through version 2. The vulnerability does not impact confidentiality or availability but allows integrity loss. It affects elasticsearch versions prior to 9.2.8-r13. A patch is available in version 9.2.8-r13 to address this issue.
A security vulnerability in Elasticsearch versions prior to 9.2.8-r13 involves the Reactor Netty WebSocket client potentially leaking credentials during WebSocket handshake redirects to a different origin. This issue has been assigned CVE-2026-47848 and carries a medium severity rating with a CVSS score of 6.1. The vulnerability is fixed in version 9.2.8-r13.
A security vulnerability in Elasticsearch affects versions prior to 9.2.8-r13. The issue arises when the Reactor Netty HTTP Server incorrectly evaluates the remote IP address in specific scenarios where the HAProxy Protocol is enabled. This flaw can lead to incorrect handling of client IP information.
A security vulnerability in Elasticsearch affects versions prior to 9.2.8-r13. In specific scenarios where multiple clients have different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. This can lead to limited impact on integrity without affecting confidentiality or availability. The issue has been fixed in version 9.2.8-r13.
A medium severity vulnerability in Elasticsearch occurs when a client sends HTTP/1 requests. This flaw affects versions prior to 9.2.8-r13 and can cause availability impact without compromising confidentiality or integrity.
A high-severity vulnerability in Elasticsearch affects versions prior to 9.2.8-r13. The issue lies in the Smile parser component of the FasterXML jackson-dataformats-binary library, which fails to invoke StreamReadConstraints. This flaw can lead to denial of service conditions due to the inability to enforce stream read limits.
A security vulnerability in the elasticsearch package involves a CBOR-parsing issue in the jackson-dataformats-binary CBOR module. Specifically, an unbounded run of CBOR tags causes quadratic-time growth in the TagList, leading to CPU and garbage collection exhaustion, resulting in a denial-of-service condition. This vulnerability is confirmed with proof-of-concept. It affects versions prior to 9.2.8-r13 and has a high severity rating with a CVSS score of 7.5. A patch is available in version 9.2.8-r13.
A security vulnerability exists in the Elasticsearch package where the CBOR parser in the FasterXML jackson-dataformats-binary library fails to invoke StreamReadConstraints. This flaw affects versions prior to 9.2.8-r13 and can cause a denial of service condition. The issue has been assigned CVE-2026-68495 and is rated with a high severity score of 7.5. A fix is available in version 9.2.8-r13.
The security issue identified as GO-2026-5932 affects multiple packages including loki and yunikorn-k8shim. The vulnerability has been addressed in specific later releases of these packages. No detailed impact or exploitation information is provided.
CVE-2026-78661 is a high-severity vulnerability in the Loki software affecting multiple versions prior to their respective fixed releases. The flaw involves the handling of adjacent text nodes during operations like addText and fosterParent, where appending to an existing TextNode's Data via string concatenation can lead to a security issue. The vulnerability has been addressed in versions 3.5.12-r9, 1.8.0-r3, 1.9.0-r1, 1.11.1-r6, and 1.9.1-r7.
CVE-2026-97045 is a medium severity vulnerability affecting multiple versions of the Loki software. The issue occurs in the childTextNodesAreLiteral function, where tree traversal previously stopped incorrectly at the nearest foreign ancestor upon encountering an HTML integration point. This flaw has been addressed in fixed versions 3.5.12-r9, 1.8.0-r3, 1.9.0-r1, 1.11.1-r6, and 1.9.1-r7.
A high-severity security vulnerability (CVE-2026-32952) affects the yunikorn-k8shim package versions prior to 1.8.0-r4. The issue involves the go-ntlmssp Go package, which provides NTLM/Negotiate authentication over HTTP. The vulnerability has no impact on confidentiality or integrity but causes a denial of service (availability impact). A fix is available in version 1.8.0-r4.
A high-severity security vulnerability affects the yunikorn-k8shim package prior to version 1.8.0-r4. The issue has been resolved in version 1.8.0-r4. The vulnerability has a CVSS 4.0 base score of 8.8, indicating a network attack vector with no required privileges or user interaction, and high impact on integrity and availability.
A critical security vulnerability (CVE-2026-33186) affects the yunikorn-k8shim package, specifically related to the gRPC-Go implementation. Versions prior to 1.8.0-r4 are vulnerable. The flaw has a high impact on confidentiality and integrity but does not affect availability. A patch is available in version 1.8.0-r4.