CLSA-2026-1782781166 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.37-tuxcare.7...

CLSA-2026-1782435547 TuxCare security update for @angular (14 CVEs)

TuxCare rebuilt 17 @angular packages to address 14 CVEs. Fixed in 12.2.17-tuxcare.7...

CLSA-2026-1781139159 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 19 @angular packages to address 1 CVE. Fixed in 10.2.5-tuxcare.7...

CLSA-2026-1780447828 TuxCare security update for 7 packages (2 CVEs)

TuxCare rebuilt 7 packages to address 2 CVEs. Fixed in 20.2.0-tuxcare.1...

CLSA-2026-1777250301 TuxCare security update for 3 packages (3 CVEs)

TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 4.5.5-tuxcare.7...

CLSA-2026-1776386124 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 18.2.14-tuxcare.7...

CLSA-2026-1775608273 TuxCare security update for 35 packages (1 CVE)

TuxCare rebuilt 35 packages to address 1 CVE. Fixed in 8.5.100-tuxcare.7...

CLSA-2026-1775521853 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 17.3.12-tuxcare.7...

CLSA-2026-1774484511 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.8.16-tuxcare.7...

CVE-2026-14872: Improper Neutralization of Special Elements used in an SQL Command

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

PT-2026-74671

TuxCare rebuilt zendframework/zendframework1 to address 7 CVEs. Fixed in 1.12.10-p2+tuxcare...

PT-2026-73775

TuxCare rebuilt zendframework/zendframework1 to address 7 CVEs. Fixed in 1.12.10-p1+tuxcare...

Oracle Linux 10 : nodejs-nodemon (ELSA-2026-48032)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-48032 advisory. 3.1.14-2 - Regenerete sources. 3.1.14-1 - Update to version 3.1.14 3.0.3-7 - revert of ce0df1a 3.0.3-6 - deps: revert letting nodemon work with any node Tenab...

Critical: Red Hat Security Advisory: perl-GD security update

An update for perl-GD is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2026-76182

Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS7 or S/MIME signed...

RHEL 7 : gstreamer1-plugins-good (RHSA-2026:49603)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:49603 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a...

CVE-2026-14164 affecting package libarchive for versions less than 3.7.7-7

CVE-2026-14164 affecting package libarchive for versions less than 3.7.7-7. A patched version of the package is available...

CVE-2026-56852 affecting package kata-containers for versions less than 3.19.1.kata3-7

CVE-2026-56852 affecting package kata-containers for versions less than 3.19.1.kata3-7. A patched version of the package is available...

CVE-2026-63220 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request a...

JLSEC-2026-830

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file...