CLSA-2026-1789363246 TuxCare security update for commons-configuration:commons-configuration (2 CVEs)

TuxCare rebuilt commons-configuration:commons-configuration to address 2 CVEs. Fixed in 1.6-tuxcare.1...

CLSA-2026-1789363119 TuxCare security update for commons-configuration:commons-configuration (1 CVE)

TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.8-tuxcare.1...

CLSA-2026-1789362482 TuxCare security update for commons-collections:commons-collections (1 CVE)

TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.1-tuxcare.1...

PT-2026-97765

TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.9.0-tuxcare.1...

PT-2026-97766

TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.10.0-tuxcare.1...

PT-2026-97762

TuxCare rebuilt commons-io:commons-io to address 2 CVEs. Fixed in 2.1-tuxcare.1...

PT-2026-97764

TuxCare rebuilt commons-io:commons-io to address 2 CVEs. Fixed in 2.3-tuxcare.1...

PT-2026-97737

TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.1-tuxcare.1...

PT-2026-97738

TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.8-tuxcare.1...

PT-2026-97739

TuxCare rebuilt commons-configuration:commons-configuration to address 2 CVEs. Fixed in 1.6-tuxcare.1...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091341)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091341 advisory. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded...

CLSA-2026-1789225570 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.6...

CLSA-2026-1789201689 TuxCare security update for commons-configuration:commons-configuration (1 CVE)

TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.2...

PT-2026-96696

TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.2...

PT-2026-96882

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.6...

GHSA-RQX4-3F6Q-3X2V @Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59148 via @mockoon/commons-server (>=9.0.0, <=9.6.1)

@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59148 Source advisory: OSV:GHSA-RQX4-3F6Q-3X2V...

GHSA-8WQC-V2Q8-VFF2 @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...

@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...