CLSA-2026-1790965180 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 5.9.0-tuxcare.3...

CLSA-2026-1790965158 TuxCare security update for browserslist (1 CVE)

TuxCare rebuilt browserslist to address 1 CVE. Fixed in 2.11.3-tuxcare.3...

CLSA-2026-1790963499 TuxCare security update for tar-fs (3 CVEs)

TuxCare rebuilt tar-fs to address 3 CVEs. Fixed in 2.1.1-tuxcare.1...

3lc (>=2.3.84, <=2.22.0), 3lc-ultralytics (>=0.1.0, <=0.2.1) +2607 more potentially affected by CVE-2026-104851 via fsspec (>=0.9.0, <=2026.4.0)

fsspec PYPI version =0.9.0, =2.3.84, =0.1.0, =0.3.2, =1.1.0, =0.1.0, =0.2.1, =0.1.3, =2.0.0, =0.1.0, =0.0.5a0, =1.3.0, =1.4.1 and more Source cves: CVE-2026-104851 Source advisory: MEND:CVE-2026-104851...

abliterix (>=1.1.0, <=1.12.2), adasoft (>=0.1.0, <=0.1.1) +394 more potentially affected by CVE-2026-104851 via fsspec (>=2026.1.0, <=2026.4.0)

fsspec PYPI version =2026.1.0, =1.1.0, =0.1.0, =0.4.0, =0.2.14, =2.0.4, =0.1.0, =0.0.0, =1.1.0a20250502, =1.1.0a20250502, =1.1.0a20250502, =1.1.0rc1, =1.1.0a20250502, =1.1.0a20250502, =1.2.0rc1 and more Source cves: CVE-2026-104851 Source advisory: SNYK:PYTHON-FSSPEC-20419437...

CLSA-2026-1790958488 TuxCare security update for org.springframework.data (1 CVE)

TuxCare rebuilt 5 org.springframework.data packages to address 1 CVE. Fixed in 3.7.16-tuxcare.2...

@9troisquarts/ant-form (>=2.0.1, <=4.0.5), @activepieces/piece-jira-cloud (>=0.1.13, <=0.3.6) +672 more potentially affected by CVE-2026-104847 via prosemirror-view (>=0.11.2, <=1.42.2)

prosemirror-view NPM version =0.11.2, =2.0.1, =0.1.13, =3.0.0-beta.4, =0.4.0, =11.21.3, =0.1.0, =11.19.4, =11.13.0, =0.0.1, =0.0.1, =13.1.0, =1.7.5, =4.0.4 and more Source cves: CVE-2026-104847 Source advisory: MEND:CVE-2026-104847...

CLSA-2026-1790952864 TuxCare security update for org.springframework (13 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 13 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.6...

CLSA-2026-1790952166 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.5...

CLSA-2026-1790951905 TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.7.16-tuxcare.2...

0lever-utils (>=0.1.0, <=0.1.6), agents-schema (>=0.0.8, <=0.0.11) +252 more potentially affected by CVE-2026-94654 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.8, =0.1.0, =0.1.0, =0.0.1, =1.0.1, =0.1.0, =0.13.3, =0.6.6, =1.0.6, =2.7.0rc1, =0.1.0, =0.0.32, =0.1.9, =0.1.12 and more Source cves: CVE-2026-94654 Source advisory: SNYK:PYTHON-THRIFT-20571817...

CLSA-2026-1790950461 TuxCare security update for terser (1 CVE)

TuxCare rebuilt terser to address 1 CVE. Fixed in 4.8.0-tuxcare.1...

CLSA-2026-1790950178 TuxCare security update for browserslist (1 CVE)

TuxCare rebuilt browserslist to address 1 CVE. Fixed in 3.2.8-tuxcare.2...

DEBIAN-CVE-2026-94657

Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

DEBIAN-CVE-2026-94656

Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-105947 CVE-2026-83632 affecting package thrift 0.24.0-1

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66858

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

AZL-106590 CVE-2026-66859 affecting package thrift 0.24.0-1

NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-105950 CVE-2026-66858 affecting package thrift 0.24.0-1

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

UBUNTU-CVE-2026-83632

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...