CLSA-2026-1792190438 flatpak: Fix of CVE-2026-96275

CVE-2026-96275: prevent extra-data path traversal by validating names and using fd-relative extraction and apply operations...

CVE-2026-49410

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login...

UBUNTU-CVE-2026-68498

StreamReadConstraints.maxNameLength default 50,000 characters is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength default 100,000,000 characters that bounds ordinary string values. For parsers bui...

CLSA-2026-1792188893 TuxCare security update for mongoose (1 CVE)

TuxCare rebuilt mongoose to address 1 CVE. Fixed in 9.7.1-tuxcare.1...

CVE-2026-49410

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login...

CVE-2026-49410 OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login...

ai.covia:covia-claude-code (>=0.9.3, <=0.10.0), ai.covia:covia-discord (>=0.9.4, <=0.9.9) +10636 more potentially affected by CVE-2026-68498 via com.fasterxml.jackson.core:jackson-core (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.1.0-beta.1, =0.1.1, =1.4.0, =2.0.0 and more Source cves: CVE-2026-68498 Source advisory: MEND:CVE-2026-68498...

ac.pao:reports-java-engine (>=1.0.0, <=1.1.0), ae.alphapay:alphapay-gateway-client (2.0.0) +44598 more potentially affected by CVE-2026-68498 via com.fasterxml.jackson.core:jackson-core (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.16.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.1, =0.1.0-rc4, =0.1.0-rc4, =0.1.3, =0.1.4 and more Source cves: CVE-2026-68498 Source advisory: MEND:CVE-2026-68498...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +11345 more potentially affected by CVE-2026-112900 via pillow (>=2.6.1, <=12.3.0)

pillow PYPI version =2.6.1, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-112900 Source advisory: SNYK:PYTHON-PILLOW-21277713...

CLSA-2026-1792184156 TuxCare security update for protobufjs (8 CVEs)

TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 6.11.3-tuxcare.2...

CLSA-2026-1792183680 TuxCare security update for svgo (3 CVEs)

TuxCare rebuilt svgo to address 3 CVEs. Fixed in 2.8.2-tuxcare.1...

com.github.sarxos:webcam-capture-driver-javacv (0.3.10), info.kapable:automationscenarioapi (1.0.0) +3 more potentially affected by CVE-2026-102834 via org.bytedeco:javacv (0.8)

org.bytedeco:javacv MAVEN version 0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.bytedeco:javacv and may be impacted: - com.github.sarxos:webcam-capture-driver-javacv 0.3.10 - info.kapable:automationscenarioapi 1.0.0 - org.bytedeco:procamcalib...

org.bytedeco:procamcalib (0.10), org.bytedeco:procamtracker (0.10) potentially affected by CVE-2026-102834 via org.bytedeco:javacv (0.10)

org.bytedeco:javacv MAVEN version 0.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.bytedeco:javacv and may be impacted: - org.bytedeco:procamcalib 0.10 - org.bytedeco:procamtracker 0.10 Source cves: CVE-2026-102834 Source advisory:...

org.bytedeco:procamcalib (0.9), org.bytedeco:procamtracker (0.9) potentially affected by CVE-2026-102834 via org.bytedeco:javacv (0.9)

org.bytedeco:javacv MAVEN version 0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.bytedeco:javacv and may be impacted: - org.bytedeco:procamcalib 0.9 - org.bytedeco:procamtracker 0.9 Source cves: CVE-2026-102834 Source advisory:...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0, <=5.0.4) potentially affected by CVE-2026-108743 via org.apache.kylin:kylin-core-common (>=5.0.0, <=5.0.4)

org.apache.kylin:kylin-core-common MAVEN version =5.0.0, =5.0.0, =5.0.4 Source cves: CVE-2026-108743 Source advisory: MEND:CVE-2026-108743...

agent-framework-claude (>=1.0.0b260319, <=1.0.0b260521), agent-webkit-server (>=0.1.0, <=0.2.0) +43 more potentially affected by CVE-2026-96620 via claude-agent-sdk (>=0.1.20, <=0.2.120)

claude-agent-sdk PYPI version =0.1.20, =1.0.0b260319, =0.1.0, =0.1.0, =0.1.0, =8.1.0, =0.3.12, =0.3.0, =0.4.0, =0.1.12, =0.4.3, =0.1.0, =0.1.2 - expluro 0.9.0 - glyph-agents 0.3.0 - gobby 0.3.4 - home-agent 0.1.1 and more Source cves: CVE-2026-96620 Source advisory: GHSA-H4MW-J7QP-8MWM...

agent-framework-claude (>=1.0.0b260319, <=1.0.0b260521), agent-webkit-server (>=0.1.0, <=0.2.0) +43 more potentially affected by CVE-2026-96620 via claude-agent-sdk (>=0.1.20, <=0.2.120)

claude-agent-sdk PYPI version =0.1.20, =1.0.0b260319, =0.1.0, =0.1.0, =0.1.0, =8.1.0, =0.3.12, =0.3.0, =0.4.0, =0.1.12, =0.4.3, =0.1.0, =0.1.2 - expluro 0.9.0 - glyph-agents 0.3.0 - gobby 0.3.4 - home-agent 0.1.1 and more Source cves: CVE-2026-96620 Source advisory: OSV:GHSA-H4MW-J7QP-8MWM...

CLSA-2026-1792169287 libtiff: Fix of 13 CVEs

Build the rhel7-els target with dist .el79 to match the RHEL 7 ELS vendor package suffix...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0, <=5.0.4) potentially affected by CVE-2026-108709 via org.apache.kylin:kylin-core-common (>=5.0.0, <=5.0.4)

org.apache.kylin:kylin-core-common MAVEN version =5.0.0, =5.0.0, =5.0.4 Source cves: CVE-2026-108709 Source advisory: MEND:CVE-2026-108709...

UBUNTU-CVE-2025-55653

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function utils/error.c. Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac to divide by zero, terminating the process with SIGFPE...