CLSA-2025-1754006614 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.4-tuxcare.1...

CLSA-2025-1751328213 TuxCare security update for commons-httpclient:commons-httpclient (1 CVE)

TuxCare rebuilt commons-httpclient:commons-httpclient to address 1 CVE. Fixed in 3.1.tuxcare.1...

CLSA-2025-1754611416 TuxCare security update for io.netty (1 CVE)

TuxCare rebuilt 47 io.netty packages to address 1 CVE. Fixed in 4.1.115.Final-tuxcare.1...

CLSA-2025-1738627240 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18.tuxcare.4...

CLSA-2024-1733443230 TuxCare security update for com.nimbusds:nimbus-jose-jwt (1 CVE)

TuxCare rebuilt com.nimbusds:nimbus-jose-jwt to address 1 CVE. Fixed in 9.24.4.tuxcare...

CLSA-2024-1727136032 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.39.tuxcare.1...

CLSA-2025-1743120048 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.39.tuxcare.4...

CLSA-2024-1733097627 TuxCare security update for org.apache.kafka (1 CVE)

TuxCare rebuilt 47 org.apache.kafka packages to address 1 CVE. Fixed in 3.2.3.tuxcare...

Malicious code in @onereach/styles (npm)

npm/@onereach/styles is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

MAL-2026-11635 Malicious code in @onereach/si-datepicker (npm)

npm/@onereach/si-datepicker is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11605 Malicious code in @onereach/idw-ui-components (npm)

npm/@onereach/idw-ui-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11626 Malicious code in @onereach/rwc-client (npm)

npm/@onereach/rwc-client is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.1-0.5.1.hum1 aarch64, x8664 grafana13.1-13.1.1-0.5.1.hum1.src src Security Fixes: grafana13.1: CVE-2026-69152 CVE-2026-69153...

PYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summary pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An...

PYSEC-2026-3607 proot-distro has a Container Isolation Bypass via Crafted Restore Archive

Affected Component - Package: proot-distro - Affected command: restore - Attack surface: Host-side Termux CLI processing a user-supplied backup archive - Vulnerability type: Container Isolation Bypass / Cross-Container Read and Write --- Affected Versions | Component | Version | |---|---| |...

CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild

Overview On August 2, 2026, N-able published a security advisory for CVE-2026-18577, an authentication bypass vulnerability affecting N-central that was discovered being exploited in-the-wild after an incomplete fix for an earlier authentication bypass issue, CVE-2026-18556 was disclosed...

RHSA-2026:49700 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7 security update

Bulletin has no description...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...