UBUNTU-CVE-2026-111755

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...

UBUNTU-CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

UBUNTU-CVE-2025-60480

A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CLSA-2026-1792432148 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792432147 TuxCare security update for @babel/plugin-transform-spread (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-spread to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

CLSA-2026-1792432146 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792432145 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

CLSA-2026-1792432141 TuxCare security update for @babel/plugin-transform-spread (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-spread to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792432138 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

CLSA-2026-1792432140 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792432136 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

CLSA-2026-1792432139 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

CLSA-2026-1792432137 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

CLSA-2026-1792431627 TuxCare security update for com.fasterxml.jackson.core:jackson-core (5 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 5 CVEs. Fixed in 2.15.0-tuxcare.1...

CLSA-2026-1792431625 TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.1-tuxcare.2...

CLSA-2026-1792431620 TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.16.1-tuxcare.1...

@asermax/tachikoma (>=3.67.0, <=3.81.0), @chitrank2050/monoline-docs (>=0.1.0, <=0.3.0) +95 more potentially affected by CVE-2026-111759 via markdown-it (>=15.0.0, <=15.0.1)

markdown-it NPM version =15.0.0, =3.67.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.2.1 and more Source cves: CVE-2026-111759 Source advisory: MEND:CVE-2026-111759...

CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuin...

UBUNTU-CVE-2026-111750

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTPNOEXTENSIONS or otherwise runs without a...

UBUNTU-CVE-2026-111748

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme...