CLSA-2025-1762906009 TuxCare security update for ch.qos.logback (4 CVEs)

TuxCare rebuilt 6 ch.qos.logback packages to address 4 CVEs. Fixed in 1.1.7-tuxcare.1...

CLSA-2025-1766275693 TuxCare security update for 90 packages (7 CVEs)

TuxCare rebuilt 90 packages to address 7 CVEs. Fixed in 9.4.48.v20220622-tuxcare.1...

CLSA-2025-1764547660 TuxCare security update for 88 packages (1 CVE)

TuxCare rebuilt 88 packages to address 1 CVE. Fixed in 9.4.53.v20231009-tuxcare.2...

CLSA-2025-1751328204 TuxCare security update for log4j:log4j (6 CVEs)

TuxCare rebuilt log4j:log4j to address 6 CVEs. Fixed in 1.2.17.tuxcare.1...

CLSA-2025-1738627240 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18.tuxcare.4...

Malicious code in @servicetitan/culture (npm)

npm/@servicetitan/culture is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

MAL-2026-11875 Malicious code in @servicetitan/hammer-token (npm)

npm/@servicetitan/hammer-token is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/idw-ui-components (npm)

npm/@onereach/idw-ui-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Important: Red Hat Security Advisory: python3 security update

An update for python3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

PYSEC-2026-3610 pypdf: Possible long runtimes for repeated malformed cross-reference entries

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consider applying the changes fr...

PYSEC-2026-3613 pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. It only affects the ASCII85 and ASCIIHex filters. Patches This...

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

SummaryHeap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read i...

PYSEC-2026-3611 pypdf: Possible large memory usage for wrong image dimensions

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consid...

CVE-2026-14838

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Security Bulletin:IP-Address Library Vulnerability: XSS Risk with Untrusted Input Rendering and HTML Escaping Issues

Summary ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage emitted by the...

EUVD-2026-52653

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14194

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Path Traversal. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-15721

Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

Moderate: Red Hat Security Advisory: systemd security, bug fix, and enhancement update

An update for systemd is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...