CLSA-2026-1775003187 TuxCare security update for org.apache.thrift (1 CVE)

TuxCare rebuilt 2 org.apache.thrift packages to address 1 CVE. Fixed in 0.9.1-tuxcare.4...

CLSA-2026-1774916752 TuxCare security update for org.apache.thrift (1 CVE)

TuxCare rebuilt 2 org.apache.thrift packages to address 1 CVE. Fixed in 0.9.3-tuxcare.4...

CLSA-2026-1774916733 TuxCare security update for node-forge (6 CVEs)

TuxCare rebuilt node-forge to address 6 CVEs. Fixed in 0.10.0-tuxcare.4...

CLSA-2026-1775003157 TuxCare security update for 38 packages (2 CVEs)

TuxCare rebuilt 38 packages to address 2 CVEs. Fixed in 9.0.90-tuxcare.4...

CLSA-2026-1774052360 TuxCare security update for angular (3 CVEs)

TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.5.11-tuxcare.4...

CLSA-2026-1774052351 TuxCare security update for angular (1 CVE)

TuxCare rebuilt angular to address 1 CVE. Fixed in 1.6.10-tuxcare.4...

CLSA-2026-1773447392 TuxCare security update for jspdf (4 CVEs)

TuxCare rebuilt jspdf to address 4 CVEs. Fixed in 3.0.4-tuxcare.4...

CLSA-2026-1773620208 TuxCare security update for jspdf (1 CVE)

TuxCare rebuilt jspdf to address 1 CVE. Fixed in 2.5.2-tuxcare.4...

CLSA-2026-1770768569 TuxCare security update for 38 packages (1 CVE)

TuxCare rebuilt 38 packages to address 1 CVE. Fixed in 9.0.50-tuxcare.4...

CLSA-2025-1743120048 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.39.tuxcare.4...

CVE-2026-61514 Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456

Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field i...

CVE-2026-8508

The CVE applies to Zyxel WAX650S devices with firmware up to 7.10(ABRM.4)C0, where the social_login.cgi CGI component performs improper authentication. This could allow a WLAN attacker to bypass captive portal authentication, implying an authentication bypass vulnerability in the device’s login f...

PT-2026-73917

TuxCare rebuilt jquery-validation to address 4 CVEs. Fixed in 1.19.0-tuxcare.1...

PT-2026-74561

TuxCare rebuilt 11 packages to address 4 CVEs. Fixed in 4.5.0-tuxcare.5...

SUSE CVE-2026-17346

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

SUSE CVE-2026-17350

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-68583

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...

CVE-2026-68583

Luci-app-adblock-fast prior to 1.2.4-4 contains a stored XSS in the blocklist name field. When an administrator views the AdBlock Fast status page, the payload executes in the administrator’s browser under the LuCI origin. Affected version is 1.2.4-3 and earlier; upgrade to 1.2.4-4 or later to re...

CVE-2026-67332

Technical details (affected products/versions/mitigation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-67332 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...