UBUNTU-CVE-2026-61812

GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion...

CLSA-2026-1790893546 TuxCare security update for fast-uri (1 CVE)

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.2-tuxcare.3...

CLSA-2026-1790890883 TuxCare security update for ip-address (3 CVEs)

TuxCare rebuilt ip-address to address 3 CVEs. Fixed in 7.1.0-tuxcare.4...

CLSA-2026-1790889495 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.2.1-tuxcare.3...

CLSA-2026-1790889438 TuxCare security update for axios (2 CVEs)

TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.33.0-tuxcare.4...

CLSA-2026-1790888307 TuxCare security update for piscina (1 CVE)

TuxCare rebuilt piscina to address 1 CVE. Fixed in 4.8.0-tuxcare.1...

CLSA-2026-1790888294 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.3...

CLSA-2026-1790888237 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.1...

CLSA-2026-1790888210 TuxCare security update for devalue (5 CVEs)

TuxCare rebuilt devalue to address 5 CVEs. Fixed in 5.9.2-tuxcare.1...

GO-2026-6579 OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao

OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao...

GO-2026-6554 OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao

OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao...

CVE-2026-53964

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

CVE-2026-55251

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

EUVD-2026-91047

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

CVE-2026-53964 Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

CVE-2026-53964

The Document Merge Service is vulnerable to Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in versions prior to 9.1.0 . The flaw exists because the xltpl library uses a non-sandboxed Jinja environment to process XLSX templates . An attacker can supply malicious template con...

CVE-2026-53964 Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

CLSA-2026-1790884245 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 10 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.3...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

EUVD-2026-91045

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...