EUVD-2026-63331

Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...

CLSA-2026-1784682964 TuxCare security update for multiparty (12 CVEs)

TuxCare rebuilt multiparty to address 12 CVEs. Fixed in 3.3.2-tuxcare.1...

CLSA-2026-1781830592 TuxCare security update for flatted (12 CVEs)

TuxCare rebuilt flatted to address 12 CVEs. Fixed in 3.3.2-tuxcare.1...

CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

DEBIAN-CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

UBUNTU-CVE-2026-65913

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USEPROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as...

CVE-2026-65914

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper...

CVE-2026-65913

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USEPROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as...

CVE-2026-65912

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.2 (TPU)

Red Hat AI Base Images 3.3.2 TPU is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.2 (CUDA 13.0)

Red Hat AI Base Images 3.3.2 CUDA 13.0 is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.2 (ROCm 7.0)

Red Hat AI Base Images 3.3.2 ROCm 7.0 is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.2 (CUDA 12.9)

Red Hat AI Base Images 3.3.2 CUDA 12.9 is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.2 (Spyre)

Red Hat AI Base Images 3.3.2 Spyre is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.2 (Neuron)

Red Hat AI Base Images 3.3.2 Neuron is now available. Red Hat® AI Base Images...

Malicious code in orchestr8-platform (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9526ae43236ac15964b307175384455975ace26d8157ef3c41ed8db8192562 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-5321 Malicious code in orchestr8-platform (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9526ae43236ac15964b307175384455975ace26d8157ef3c41ed8db8192562 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

SUSE CVE-2026-44699

LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not contain an alg parameter as the verification key for an HS256/HS384/HS512 token. In the OpenSSL backend, this causes HMAC verification to run with a zero-length key, so an attacker can forge a valid...