PT-2026-104289

Name of the Vulnerable Software and Affected Versions Apache Thrift C++ library versions 0.7.0 through 0.24.0 Apache Thrift D library versions 0.9.0 through 0.24.0 Description Improper validation of certificates with host mismatches occurs in the C++ and D libraries. The default access manager fo...

OPENSUSE-SU-2026:11953-1 aliyun-cli-3.5.1-2.1 on GA media

These are all security issues fixed in the aliyun-cli-3.5.1-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11978-1 yast2-users-5.0.9-1.1 on GA media

These are all security issues fixed in the yast2-users-5.0.9-1.1 package on the GA media of openSUSE Tumbleweed...

21millionpixels-mcp (>=0.2.0, <=0.2.1), @0xkillaflow/agama-redmine-mcp (>=1.0.0, <=2.1.0) +4898 more potentially affected by unknown CVE via @modelcontextprotocol/sdk (>=1.24.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.24.0, =0.2.0, =1.0.0, =0.1.3, =0.1.8, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =8.0.0, =0.14.0, =0.1.0, =0.2.0, =0.7.0, =1.0.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0090...

PT-2026-104324

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The protocol skip routine in several Apache Thrift bindings fails to apply the recursion limit. This allows a message containing deeply nested unknown fields to exhaust the stack, potentially...

OPENSUSE-SU-2026:11964-1 helm3-3.22.0-3.1 on GA media

These are all security issues fixed in the helm3-3.22.0-3.1 package on the GA media of openSUSE Tumbleweed...

CLSA-2026-1790893546 TuxCare security update for fast-uri (1 CVE)

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.2-tuxcare.3...

CLSA-2026-1790890883 TuxCare security update for ip-address (3 CVEs)

TuxCare rebuilt ip-address to address 3 CVEs. Fixed in 7.1.0-tuxcare.4...

CLSA-2026-1790889495 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.2.1-tuxcare.3...

CLSA-2026-1790889438 TuxCare security update for axios (2 CVEs)

TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.33.0-tuxcare.4...

awsidr (>=1.0.0, <=1.0.9), rds-proxy-password-rotation (>=0.5.8, <=0.6.556) potentially affected by CVE-2026-104002 via aws-lambda-powertools (>=3.7.0, <=3.34.0)

aws-lambda-powertools PYPI version =3.7.0, =1.0.0, =0.5.8, =0.6.556 Source cves: CVE-2026-104002 Source advisory: MEND:CVE-2026-104002...

CLSA-2026-1790888307 TuxCare security update for piscina (1 CVE)

TuxCare rebuilt piscina to address 1 CVE. Fixed in 4.8.0-tuxcare.1...

CLSA-2026-1790888294 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.3...

CLSA-2026-1790888237 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.1...

CLSA-2026-1790888210 TuxCare security update for devalue (5 CVEs)

TuxCare rebuilt devalue to address 5 CVEs. Fixed in 5.9.2-tuxcare.1...

GO-2026-6554 OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao

OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao...

GO-2026-6579 OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao

OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao...

CVE-2026-55251

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-53964

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

0beny1s (1.1.6), 0x404 (1.1.4) +14146 more potentially affected by CVE-2026-104182 via stream-json (>=0.4.2, <=3.5.0)

stream-json NPM version =0.4.2, =0.0.2, =0.0.7, =0.0.0-20251106131028, =0.0.2, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.10 and more Source cves: CVE-2026-104182 Source advisory: MEND:CVE-2026-104182...