CLSA-2026-1780361386 TuxCare security update for io.netty (1 CVE)

TuxCare rebuilt 47 io.netty packages to address 1 CVE. Fixed in 4.1.112.Final-tuxcare.4...

CLSA-2026-1778719545 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 5.3.37-tuxcare.4...

CLSA-2026-1776213256 TuxCare security update for 39 packages (3 CVEs)

TuxCare rebuilt 39 packages to address 3 CVEs. Fixed in 9.0.100-tuxcare.4...

CLSA-2026-1774916733 TuxCare security update for node-forge (6 CVEs)

TuxCare rebuilt node-forge to address 6 CVEs. Fixed in 0.10.0-tuxcare.4...

CLSA-2026-1775003157 TuxCare security update for 38 packages (2 CVEs)

TuxCare rebuilt 38 packages to address 2 CVEs. Fixed in 9.0.90-tuxcare.4...

CLSA-2026-1774052360 TuxCare security update for angular (2 CVEs)

TuxCare rebuilt angular to address 2 CVEs. Fixed in 1.5.11-tuxcare.4...

CLSA-2026-1774052351 TuxCare security update for angular (1 CVE)

TuxCare rebuilt angular to address 1 CVE. Fixed in 1.6.10-tuxcare.4...

CVE-2026-61514 Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456

Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field i...

CVE-2026-8508

The CVE applies to Zyxel WAX650S devices with firmware up to 7.10(ABRM.4)C0, where the social_login.cgi CGI component performs improper authentication. This could allow a WLAN attacker to bypass captive portal authentication, implying an authentication bypass vulnerability in the device’s login f...

CVE-2026-68583

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...

CVE-2026-68583

Luci-app-adblock-fast prior to 1.2.4-4 contains a stored XSS in the blocklist name field. When an administrator views the AdBlock Fast status page, the payload executes in the administrator’s browser under the LuCI origin. Affected version is 1.2.4-3 and earlier; upgrade to 1.2.4-4 or later to re...

CVE-2026-67332 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

CVE-2026-67332

Technical details (affected products/versions/mitigation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-17347

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17566 pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...

CVE-2026-17566

Summary of CVE-2026-17566 (pgAdmin 4): The Import/Export Data tool builds a psql \copy (...) command by interpolating a user-supplied SQL query into a Jinja template and passing it via --command. A flawed parenthesis-balance check in create_import_export_job() treated a backslash-quote (') as esc...

CVE-2026-17351

The CVE-2026-17351 issue affects pgAdmin 4 (versions from 9.13 up to, but not including, 9.17). The vulnerability stems from a mismatch between sqlparse’s string-literal handling and PostgreSQL’s parser, which can allow an LLM-supplied query executed inside a BEGIN TRANSACTION READ ONLY wrapper t...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

EUVD-2026-51560

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17346 pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...