CVE-2026-55620: Allocation of Resources Without Limits or Throttling

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based...

CVE-2026-65637: Improper Input Validation

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...

PT-2026-81183

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

PT-2026-81363

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in SystemTwigSecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models...

python3.12 security update

3.12.14-1.0.1 - Remove upstream URL reference 3.12.14-1 - Update to Python 3.12.14 Resolves: RHEL-227215 3.12.13-3.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193793...

Oracle Linux 9 : python3.12 (ELSA-2026-59009)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-59009 advisory. 3.12.14-1.0.1 - Remove upstream URL reference 3.12.14-1 - Update to Python 3.12.14 Resolves: RHEL-227215 3.12.13-3.1 - Security fix for CVE-2026-15308 Resolves...

PT-2026-81123

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /evil.com whose second character is a...

PT-2026-81375

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp process server msg the code calls atoistrtok ruid, "-", &tmp without checking the strtok r return value. When the server-supplied uid is empty or contains...

mod_http2 security, bug fix, and enhancement update

2.0.26-6.2 - Resolves: RHEL-190583 - address CVE-2026-43951 and CVE-2026-48913 in modhttp2...

nodejs24 security update

1:24.18.0-5.0.1 - Add c-ares as dependency orabug 39781256 - Update upstream references 1:24.18.0-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:24.18.0-4 - Fix CVE-2026-13149 brace-expansion...

Important: Red Hat Security Advisory: RHACS 4.10.7 security and bug fix update

Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...

Important: Red Hat Security Advisory: RHACS 4.9.11 security and bug fix update

Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...

CLSA-2026-1787602147 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.5-tuxcare.1...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CLSA-2026-1787592261 TuxCare security update for postcss (1 CVE)

TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.5...

CLSA-2026-1787592062 TuxCare security update for node-notifier (1 CVE)

TuxCare rebuilt node-notifier to address 1 CVE. Fixed in 7.0.2-tuxcare.1...

CLSA-2026-1787592038 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.15.0-tuxcare.1...

CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

CVE-2026-63621 Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...