CLSA-2026-1770682160 TuxCare security update for marked (1 CVE)

TuxCare rebuilt marked to address 1 CVE. Fixed in 4.0.8-tuxcare.1...

CLSA-2026-1770163741 TuxCare security update for 86 packages (2 CVEs)

TuxCare rebuilt 86 packages to address 2 CVEs. Fixed in 9.4.59.tuxcare00001...

CLSA-2025-1759277170 TuxCare security update for com.querydsl (1 CVE)

TuxCare rebuilt 2 com.querydsl packages to address 1 CVE. Fixed in 5.1.0-tuxcare.1...

CLSA-2025-1761696401 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 8 CVEs. Fixed in 5.3.31-tuxcare.1...

CLSA-2025-1760313984 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.1...

CLSA-2025-1760918790 TuxCare security update for com.google.code.gson:gson (1 CVE)

TuxCare rebuilt com.google.code.gson:gson to address 1 CVE. Fixed in 2.9.1-tuxcare.1...

CLSA-2025-1761177997 TuxCare security update for org.json:json (1 CVE)

TuxCare rebuilt org.json:json to address 1 CVE. Fixed in 20090211-tuxcare.3...

CLSA-2025-1756253007 TuxCare security update for 38 packages (18 CVEs)

TuxCare rebuilt 38 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1...

CVE-2026-18809 Information disclosure in Firefox for Android and Firefox Focus for Android

Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3...

CVE-2026-18809 Information disclosure in Firefox for Android and Firefox Focus for Android

Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3...

PYSEC-2026-3606 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

PYSEC-2026-3604 Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Summary POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool,...

CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild

Overview On August 2, 2026, N-able published a security advisory for CVE-2026-18577, an authentication bypass vulnerability affecting N-central that was discovered being exploited in-the-wild after an incomplete fix for an earlier authentication bypass issue, CVE-2026-18556 was disclosed...

SUSE CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

SUSE CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

Exploit for CVE-2026-18718

CVE-2026-18718 Arbitrary code execution in Ghi...

CVE-2026-47746 Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and...

CVE-2026-48115 Misskey: Improper Authorization in the Announcements API

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...

CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-68930

Russh is a Rust SSH library. Prior to version 0.62.5, it dispatched channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. This could allow callbacks to be reached w...