com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), io.camelbee:camelbee-quarkus-core (3.2.1) +52 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.0.0.beta1 and more Source cves: CVE-2026-97468 Source advisory: SNYK:JAVA-ORGAPACHECXF-21245928...

be.atbash.test:integration-testing (2.2.0), be.atbash.test:integration-testing-database (2.2.0) +897 more potentially affected by CVE-2026-78384 via org.apache.cxf:cxf-core (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-core MAVEN version =4.0.0, =1.0.0, =12.1-7-21, =0.0.1, =1.1.0, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons 2.70.0 and more Source cves: CVE-2026-78384 Source advisory: SNYK:JAVA-ORGAPACHECXF-20824751...

CLSA-2026-1791551168 Fix CVE(s): CVE-2024-3651

CVE-2024-3651: quadratic-time DoS in validcontextj...

CLSA-2026-1791549508 TuxCare security update for org.freemarker:freemarker (1 CVE)

TuxCare rebuilt org.freemarker:freemarker to address 1 CVE. Fixed in 2.3.34-tuxcare.1...

CLSA-2026-1791547948 TuxCare security update for io.projectreactor.netty (5 CVEs)

TuxCare rebuilt 4 io.projectreactor.netty packages to address 5 CVEs. Fixed in 1.0.48-tuxcare.5...

ROOT-OS-DEBIAN-13-CVE-2025-15366 CVE-2025-15366 in python3.13 - Patched by Root

Root has patched CVE-2025-15366 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-19445 CVE-2026-19445 in python3.13 - Patched by Root

Root has patched CVE-2026-19445 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ipg (0.2.0), ipg-cng (>=0.1.1, <=0.1.2) potentially affected by unknown CVE via ic-cipher (0.2.7)

ic-cipher CARGO version 0.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on ic-cipher and may be impacted: - ipg 0.2.0 - ipg-cng =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0337...

CLSA-2026-1791546292 Fix CVE(s): CVE-2021-33516

CVE-2021-33516: DNS rebinding in controlserverhandler...

BIT-THRIFT-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94639 Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

BIT-THRIFT-2026-66837 Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length

Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-PYTHON-MIN-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

ROOT-APP-MAVEN-CVE-2026-71497 CVE-2026-71497 in org.jsoup:jsoup - Patched by Root

Root has patched CVE-2026-71497 in the org.jsoup:jsoup package for Root:Maven. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-56000 CVE-2026-56000 in xorg-server - Patched by Root

Root has patched CVE-2026-56000 in the xorg-server package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-55999 CVE-2026-55999 in xorg-server - Patched by Root

Root has patched CVE-2026-55999 in the xorg-server package for Root:Debian:11. Multiple fixed versions available...

CLSA-2026-1791541499 ImageMagick: Fix of 2 CVEs

CVE-2026-86420: release the memory resource reserved by OpenPixelCache when the in-memory pixel cache cannot be allocated to prevent exhausting the memory budget - CVE-2026-86421: free the DrawInfo of each image released when the MSL decoder closes a group element to prevent a memory leak...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +3390 more potentially affected by CVE-2026-108039 via org.apache.cxf:cxf-core (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-core MAVEN version =3.0.0, =1.0.0, =1.11.0, =1.11.0, =1.0.0, =11.4-37, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-108039 Source advisory: MEND:CVE-2026-108039...

org.apache.cxf.systests:cxf-systests-transport-netty (>=3.5.7, <=3.6.3), org.apache.cxf:apache-cxf (>=3.0.0, <=3.6.12) +1 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =3.0.0, =3.5.7, =3.0.0, =3.0.0, =3.6.12 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...