CLSA-2026-1788955035 TuxCare security update for 4 packages (1 CVE)

TuxCare rebuilt 4 packages to address 1 CVE. Fixed in 6.3.0-tuxcare.2...

CLSA-2026-1788934711 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post6+tuxcare...

CVE-2026-71802

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

CVE-2026-71802: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

PT-2026-89151

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

EUVD-2026-75161

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

CVE-2026-71802

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3 . While the server performs HTML escaping on announcement content, the client-side preview code uses jQuery's html().text() method to reverse those escapes before injecting the result i...

CVE-2026-71802

A stored Cross-Site Scripting XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's html.text method and subsequently...

buildah security update

1.43.1-6.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.43.1-6 - Rebuild for golang CVE fixes - Resolves: RHEL-229833 RHEL-241142 RHEL-241389 RHEL-241658 RHEL-241706 RHEL-242148 RHEL-251830...

Oracle Linux 10 : ELSA-2026-64777-0: / buildah (ELSA-2026-647770)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-647770 advisory. 1.43.1-6.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.43.1-6 - Rebuild for golang CVE fixes - Resolves:...

CLSA-2026-1788892753 TuxCare security update for 4 packages (1 CVE)

TuxCare rebuilt 4 packages to address 1 CVE. Fixed in 0.26.1-tuxcare.3...

Exploit for CVE-2026-73317

CVE-2026-73317 XenForo before 2.3.13 lets an administrator wi...

CLSA-2026-1788881357 TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)

TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.2...

CLSA-2026-1788878815 TuxCare security update for 90 packages (2 CVEs)

TuxCare rebuilt 90 packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.5...

CLSA-2026-1788875719 TuxCare security update for 39 packages (1 CVE)

TuxCare rebuilt 39 packages to address 1 CVE. Fixed in 10.1.18-tuxcare.7...

CLSA-2026-1788874294 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.5.8-tuxcare.1...

CLSA-2026-1788873744 TuxCare security update for 32 packages (11 CVEs)

TuxCare rebuilt 32 packages to address 11 CVEs. Fixed in 7.0.70-tuxcare.3...

EUVD-2026-72754

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

CVE-2026-73317 XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body...

CVE-2026-73317

XenForo before 2.3.13 contains a missing authorization flaw in the ACP cache-rebuild dispatcher . An administrator holding only the rebuildCache permission can supply an arbitrary job class and actor user ID in the POST body to invoke the approval queue job under any user identity, thereby approv...