CLSA-2026-1787602147 TuxCare security update for webpack-dev-middleware (4 CVEs)

TuxCare rebuilt webpack-dev-middleware to address 4 CVEs. Fixed in 7.4.5-tuxcare.1...

CVE-2026-75509

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-75509 joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CLSA-2026-1787602039 TuxCare security update for dompurify (2 CVEs)

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.8-tuxcare.2...

actix-postgres (>=0.1.0, <=0.4.0), actyx_sdk (>=0.1.0, <=0.3.0) +574 more potentially affected by unknown CVE via postgres-protocol (>=0.1.1, <=0.6.10)

postgres-protocol CARGO version =0.1.1, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.4.0, =0.1.1, =0.4.0, =0.4.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RGQC-3X5P-6GWG...

actix-postgres (>=0.1.0, <=0.4.0), actyx_sdk (>=0.1.0, <=0.3.0) +562 more potentially affected by unknown CVE via postgres-protocol (>=0.4.0, <=0.6.10)

postgres-protocol CARGO version =0.4.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.4.0, =0.1.1, =0.4.0, =0.4.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5X78-73V4-XG6W...

CLSA-2026-1787599751 TuxCare security update for dompurify (7 CVEs)

TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.4.8-tuxcare.1...

DEBIAN-CVE-2026-71832

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrenthelper.cc, which allows a remote malicious user to cause a Denial of Service...

UBUNTU-CVE-2026-71832

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrenthelper.cc, which allows a remote malicious user to cause a Denial of Service...

abraham3k (>=1.3.8, <=1.5.3), accutuning-helpers (>=1.0.32, <=1.0.33) +75 more potentially affected by CVE-2026-76843 via flair (>=0.4.5, <=0.15.1)

flair PYPI version =0.4.5, =1.3.8, =1.0.32, =0.0.1, =0.1.0, =0.0.6, =0.1.20, =0.1.0, =0.1.0, =0.0.1.1, =0.2.4, =0.1.1, =0.0.1rc2, =0.0.1rc3488056308109 and more Source cves: CVE-2026-76843 Source advisory: SNYK:PYTHON-FLAIR-19256938...

DEBIAN-CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

UBUNTU-CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

ROOT-OS-DEBIAN-13-CVE-2026-44173 CVE-2026-44173 in mariadb - Patched by Root

Root has patched CVE-2026-44173 in the mariadb package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-15366 CVE-2025-15366 in python3.13 - Patched by Root

Root has patched CVE-2025-15366 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-11940 CVE-2026-11940 in python3.13 - Patched by Root

Root has patched CVE-2026-11940 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-0864 CVE-2026-0864 in python3.13 - Patched by Root

Root has patched CVE-2026-0864 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

CLSA-2026-1787592232 TuxCare security update for fast-uri (11 CVEs)

TuxCare rebuilt fast-uri to address 11 CVEs. Fixed in 2.4.3-tuxcare.1...

CLSA-2026-1787592038 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.15.0-tuxcare.1...

DEBIAN-CVE-2026-78465

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently larg...

DEBIAN-CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...