CLSA-2026-1790876611 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.3...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

ai.timefold.solver:timefold-solver-migration (>=1.7.0, <=1.23.0), com.alibaba.fastjson2:fastjson2-extension-spring5 (>=2.0.43, <=2.0.58) +1084 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.16.0, =1.7.0, =2.0.43, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =0.0.3, =0.0.3, =1.41.0, =1.49.1, =1.49.1, =1.50.6 and more Source cves: CVE-2026-68496 Source advisory: MEND:CVE-2026-68496...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

ch.rasc:wamp2spring-core (4.0.0), ch.rasc:wamp2spring-reactive (4.0.0) +703 more potentially affected by CVE-2026-68495 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.0.0, <=3.1.5)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.0.0, =6.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.1.1 and more Source cves: CVE-2026-68495 Source advisory: MEND:CVE-2026-68495...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.webauthn4j:webauthn4j-appattest (>=0.31.9.release, <=0.31.10.release) +393 more potentially affected by CVE-2026-68495 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.2.0, =1.43.1, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.2 and more Source cves:...

CLSA-2026-1790875447 TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.16-tuxcare.1...

CVE-2023-54404 Zod Uncontrolled Resource Consumption via Unbounded Array, Set, and Map Validation

Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in...

agatta (>=1.0.0, <=1.0.2), agentbuddy (0.1.1.dev33) +102 more potentially affected by CVE-2026-102999 via pypdf (3.17.4)

pypdf PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =1.0.0, =0.0.3, =0.0.1, =1.1.0, =0.0.2, =1.2.0, =0.6.7, =1.2.1, =0.1.3, =0.0.1, =0.8.2 - cadenai 0.1.0 and more Source cves: CVE-2026-102999...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +135 more potentially affected by CVE-2026-103000 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

chellow (>=1688456919.0.0, <=1692616986.0.0), cybrex (>=1.0.1, <=1.0.7) potentially affected by CVE-2026-102997 via pypdf (3.12.0)

pypdf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1688456919.0.0, =1.0.1, =1.0.7 Source cves: CVE-2026-102997 Source advisory: OSV:PYSEC-2026-4156...

assert-files (>=0.1.0, <=0.1.3), vpplib (0.0.4) +1 more potentially affected by CVE-2026-102997 via pypdf (3.16.4)

pypdf PYPI version 3.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - assert-files =0.1.0, =0.61.0, =0.65.0 Source cves: CVE-2026-102997 Source advisory: OSV:PYSEC-2026-4156...

athena-starship (>=0.0.3, <=0.0.6), conflare (>=0.1.2, <=0.1.3) +11 more potentially affected by CVE-2026-102997 via pypdf (4.1.0)

pypdf PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - athena-starship =0.0.3, =0.1.2, =2.2.0, =0.0.1, =3.3.0, =1.14.0, =0.1.4, =4.6.2, =0.1.0, =0.1.58 Source cves: CVE-2026-102997 Source advisory:...

cocpyth (>=0.1.1, <=0.1.2), pretix (>=4.19.0, <=4.20.4) potentially affected by CVE-2026-102998 via pypdf (3.8.1)

pypdf PYPI version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cocpyth =0.1.1, =4.19.0, =4.20.4 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-102999 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-102999 Source advisory: OSV:PYSEC-2026-4159...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +38 more potentially affected by CVE-2026-103000 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-102999 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-102999 Source...

a-data-processing (0.0.1), ab-data-processing (0.0.1) +9 more potentially affected by CVE-2026-102999 via pypdf (3.17.1)

pypdf PYPI version 3.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - a-data-processing 0.0.1 - ab-data-processing 0.0.1 - arac 0.0.1 - crate-anon 0.20.7 - generalagent =0.0.6, =0.0.1, =0.1.0, =0.0.1, =0.0.14 - pyxreade...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2026-102998 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2026-102998 Source...

chellow (>=1688456919.0.0, <=1692616986.0.0), cybrex (>=1.0.1, <=1.0.7) potentially affected by CVE-2026-103000 via pypdf (3.12.0)

pypdf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1688456919.0.0, =1.0.1, =1.0.7 Source cves: CVE-2026-103000 Source advisory: OSV:PYSEC-2026-4160...