agentfoundry (1.2.9.1), ai4rag (>=0.8.0, <=0.10.4) +41 more potentially affected by CVE-2026-105745 via docling (>=2.28.1, <=2.130.0)

docling PYPI version =2.28.1, =0.8.0, =1.0.0, =0.1.0, =0.1.0, =7.29.0, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.0.49, =0.0.51 and more Source cves: CVE-2026-105745 Source advisory: MEND:CVE-2026-105745...

ai4rag (>=0.9.0, <=0.24.0), conexus (>=7.29.0, <=7.82.0) +18 more potentially affected by CVE-2026-105744 via docling-slim (>=2.94.0, <=2.131.0)

docling-slim PYPI version =2.94.0, =0.9.0, =7.29.0, =2.94.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.0.49, =1.0.0rc1, =0.17.0, =0.7.0, =0.7.1 and more Source cves: CVE-2026-105744 Source advisory: MEND:CVE-2026-105744...

ai4rag (>=0.9.0, <=0.24.0), conexus (>=7.29.0, <=7.82.0) +16 more potentially affected by CVE-2026-105742 via docling-slim (>=2.95.0, <=2.131.0)

docling-slim PYPI version =2.95.0, =0.9.0, =7.29.0, =2.95.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.17.0, =0.7.0, =0.1.6, =0.3.0 and more Source cves: CVE-2026-105742 Source advisory: MEND:CVE-2026-105742...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105699 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105699 Source advisory: MEND:CVE-2026-105699...

CVE-2026-103629

An integer overflow flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562038679...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105698 via langflow-base (>=0.7.2, <=0.10.0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105698 Source advisory: MEND:CVE-2026-105698...

UBUNTU-CVE-2026-104030

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash a...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105697 via langflow-base (>=0.7.2, <=0.10.0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697 Source advisory: MEND:CVE-2026-105697...

CVE-2026-105642

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...

UBUNTU-CVE-2026-105326

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot b...

sign-alex (1.0.1) potentially affected by CVE-2026-105676 via ghost (1.26.2)

ghost NPM version 1.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on ghost and may be impacted: - sign-alex 1.0.1 Source cves: CVE-2026-105676 Source advisory: MEND:CVE-2026-105676...

CLSA-2026-1791226863 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.8-tuxcare.2...

CLSA-2026-1791226763 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.10-tuxcare.1...

CLSA-2026-1791226683 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.11-tuxcare.1...

CLSA-2026-1791226583 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.6-tuxcare.1...

CLSA-2026-1791226577 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.4-tuxcare.1...

CLSA-2026-1791226379 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.2...

CLSA-2026-1791225543 TuxCare security update for decompress (2 CVEs)

TuxCare rebuilt decompress to address 2 CVEs. Fixed in 4.2.1-tuxcare.1...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-104714 via org.apache.struts:struts2-core (>=6.0.0, <=6.11.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-104714 Source advisory: MEND:CVE-2...

EUVD-2026-92623

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...