CLSA-2026-1791563836 ipa: Fix of 4 CVEs

CVE-2026-73197: limit the request body size of the unauthenticated migration endpoint - CVE-2026-73198: limit the request body size of the unauthenticated i18nmessages endpoint - CVE-2026-76578: harden default ACIs and permissions against unauthenticated and delegated privilege escalation -...

CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/uuid. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete skips the...

CLSA-2026-1791558283 Fix CVE(s): CVE-2026-16118

SECURITY UPDATE: heap buffer overflow when byte-swapping MIME magic values on little-endian systems - debian/patches/CVE-2026-16118.patch: fix pointer arithmetic on the write side of the byte swap in xdgmimemagicparsemagicline - CVE-2026-16118...

ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +22465 more potentially affected by CVE-2026-108106 via org.xerial.snappy:snappy-java (>=1.0.5, <=1.1.10.8)

org.xerial.snappy:snappy-java MAVEN version =1.0.5, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2026-108106 Source advisory: MEND:CVE-2026-108106...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +36 more potentially affected by CVE-2026-107727 via strawberry-graphql (>=0.312.4, <=0.327.1)

strawberry-graphql PYPI version =0.312.4, =2025.4.0, =2025.4.0, =1.0.0, =0.9.0, =26.4.0rc1, =0.1.0a1, =0.2.0, =1.0.1, =0.1.0, =1.17.0, =0.1.0, =0.0.246, =2.0.0, =0.0.1a0, =0.1.26, =0.1.32 and more Source cves: CVE-2026-107727 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-20823901...

airo-camera-toolkit (>=2025.4.0, <=2025.7.1), airo-dataset-tools (>=2025.4.0, <=2026.5.0) +78 more potentially affected by CVE-2026-107728 via strawberry-graphql (>=0.217.0, <=0.325.0)

strawberry-graphql PYPI version =0.217.0, =2025.4.0, =2025.4.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.9.0, =25.13.0rc1, =1.2.0, =0.1.0a1, =0.2.0, =1.0.1, =2.2.1 and more Source cves: CVE-2026-107728 Source advisory: GHSA-PFVF-FWFP-25MP...

app.ductape:sdk (0.1.10), cn.loyom.boot:loyom-boot-business-demo (1.0.3-jdk21) +445 more potentially affected by CVE-2026-71884 via org.bouncycastle:bcprov-lts8on (>=2.73.4, <=2.73.12.1)

org.bouncycastle:bcprov-lts8on MAVEN version =2.73.4, =1.0.1-jdk21, =1.0.1-jdk21, =1.0.1-jdk21, =1.0.3-jdk21, =1.0.1-jdk21, =1.0.1-jdk21, =1.0.1-jdk21, =1.0.1-jdk21, =1.0.1-jdk21, =1.0.1-jdk21, =1.0.3.2-jdk21 and more Source cves: CVE-2026-71884 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20828170...

Reusing a Nonce, Key Pair in Encryption

Overview Affected versions of this package are vulnerable to Reusing a Nonce, Key Pair in Encryption in the native one-shot CTR packet path ctrpcprocesspacket, which does not check that the request fits the addressable block range and reports the full input length as a success even once the block...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +897 more potentially affected by CVE-2026-108039 via org.apache.cxf:cxf-core (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-core MAVEN version =4.0.0, =1.0.0, =12.1-7-21, =0.0.1, =1.1.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 and more Source cves: CVE-2026-108039 Source advisory: SNYK:JAVA-ORGAPACHECXF-21244413...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), io.camelbee:camelbee-quarkus-core (3.2.1) +52 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.0.0.beta1 and more Source cves: CVE-2026-97468 Source advisory: SNYK:JAVA-ORGAPACHECXF-21245928...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +897 more potentially affected by CVE-2026-78384 via org.apache.cxf:cxf-core (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-core MAVEN version =4.0.0, =1.0.0, =12.1-7-21, =0.0.1, =1.1.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 and more Source cves: CVE-2026-78384 Source advisory: SNYK:JAVA-ORGAPACHECXF-20824751...

CLSA-2026-1791551168 Fix CVE(s): CVE-2024-3651

CVE-2024-3651: quadratic-time DoS in validcontextj...

CLSA-2026-1791549508 TuxCare security update for org.freemarker:freemarker (1 CVE)

TuxCare rebuilt org.freemarker:freemarker to address 1 CVE. Fixed in 2.3.34-tuxcare.1...

CLSA-2026-1791547948 TuxCare security update for io.projectreactor.netty (5 CVEs)

TuxCare rebuilt 4 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5...

ROOT-OS-DEBIAN-13-CVE-2025-15366 CVE-2025-15366 in python3.13 - Patched by Root

Root has patched CVE-2025-15366 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-19445 CVE-2026-19445 in python3.13 - Patched by Root

Root has patched CVE-2026-19445 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ipg (0.2.0), ipg-cng (>=0.1.1, <=0.1.2) potentially affected by unknown CVE via ic-cipher (0.2.7)

ic-cipher CARGO version 0.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on ic-cipher and may be impacted: - ipg 0.2.0 - ipg-cng =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0337...

CLSA-2026-1791546292 Fix CVE(s): CVE-2021-33516

CVE-2021-33516: DNS rebinding in controlserverhandler...

BIT-THRIFT-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94639 Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...