CLSA-2026-1788560420 TuxCare security update for ws (3 CVEs)

TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.5-tuxcare.1...

CVE-2026-80760

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-80760 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-80760 Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-80760

CVE-2026-80760 affects the Linux kernel Bluetooth MGMT subsystem. The function mgmt_hci_cmd_sync() validates that the message length matches params_len but fails to enforce an upper bound. Since params_len is a 16-bit value while the HCI command header plen field is 8-bit (max 255), a value of 25...

BIT-JOOMLA-2026-72531 Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260804 - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components...

CVE-2026-82728: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. Two HTTP/1 response-parser states accumulate server data without any cap. In lib/mint/http1.ex, decodestatusline/4...

pgAdmin 4 Privilege Escalation

The vulnerability of the pgAdmin 4 database management tool is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

PT-2026-85601

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCI CMD SYNC params len above 255 mgmt hci cmd sync checks that the message length agrees with params len but puts no upper bound on it. params len is le16 while the parameter length in the HCI command...

CLSA-2026-1788430341 TuxCare security update for craftcms/cms (4 CVEs)

TuxCare rebuilt craftcms/cms to address 4 CVEs. Fixed in 3.9.15-p9+tuxcare...

CLSA-2026-1788421913 TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.4...

PT-2026-90816

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.4...

TencentOS Server 4: webkitgtk (TSSA-2026:0965)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0965 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

RHCOS 4 : OpenShift Container Platform 4.12.97 (RHSA-2026:59830)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59830 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

RHCOS 4 : OpenShift Container Platform 4.19.45 (RHSA-2026:60452)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60452 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

RHCOS 4 : OpenShift Container Platform 4.17.57 (RHSA-2026:60018)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60018 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-82398 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

FreeBSD : Erlang/OTP -- remote crash via gen_tcp with {packet,4} (62b56853-a609-11f1-9195-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 62b56853-a609-11f1-9195-4c526214c986 advisory. The OTP 29.0.6 release notes report: A gentcp socket using the inet driver and packet,4 had a bug if...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-84310 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

AZL-98499 CVE-2026-75538 affecting package erlang for versions less than 26.2.5.21-6

An attacker that connects to an open Erlang TCP port that uses the inet driver with packet,4 mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This would easily trash the allocated block'...