CLSA-2026-1790876611 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.3...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CLSA-2026-1790875447 TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.16-tuxcare.1...

CVE-2023-54404 Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic ...

PickleScan has multiple stdlib modules with direct RCE not in blocklist

Summarypicklescan v1.0.3 latest does not block at least 7 Python standard library modules that provide direct arbitrary command execution or code evaluation. A malicious pickle file importing these modules is reported as having 0 issues CLEAN scan. This enables remote code execution that bypasses...

PYSEC-2026-4134 PickleScan has multiple stdlib modules with direct RCE not in blocklist

Summary picklescan v1.0.3 latest does not block at least 7 Python standard library modules that provide direct arbitrary command execution or code evaluation. A malicious pickle file importing these modules is reported as having 0 issues CLEAN scan. This enables remote code execution that bypasse...

CVE-2026-85228

A flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can allow an attacker to obtain sensitive data from adjacent...

CLSA-2026-1790872344 TuxCare security update for drupal/core (2 CVEs)

TuxCare rebuilt drupal/core to address 2 CVEs. Fixed in 10.5.12-p1+tuxcare...

CLSA-2026-1790872226 TuxCare security update for zendframework/zendframework (1 CVE)

TuxCare rebuilt zendframework/zendframework to address 1 CVE. Fixed in 2.4.13-p2+tuxcare...

CLSA-2026-1790870726 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.5-tuxcare.1...

CLSA-2026-1790870256 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.14-tuxcare.2...

CLSA-2026-1790870000 TuxCare security update for fast-uri (1 CVE)

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.3-tuxcare.3...

CLSA-2026-1790869902 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.17-tuxcare.4...

CLSA-2026-1790869753 TuxCare security update for fast-uri (1 CVE)

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 2.4.0-tuxcare.4...

CLSA-2026-1790869488 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.15-tuxcare.2...

CLSA-2026-1790869390 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 8 @react-native-community packages to address 1 CVE. Fixed in 5.0.1-tuxcare.1...

CLSA-2026-1790868478 TuxCare security update for league/flysystem (1 CVE)

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 3.33.0-p1+tuxcare...

CLSA-2026-1790868332 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.18-tuxcare.6...

CLSA-2026-1790868324 TuxCare security update for adm-zip (1 CVE)

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.10-tuxcare.2...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +115 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.9.2)

devalue NPM version =5.0.0, =0.0.1, =0.1.0, =7.0.0, =7.0.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =0.2.0, =3.8.7, =4.0.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-HX4R-W6WJ-J8FG...