[SECURITY] Fedora 44 Update: cef-146.0.11^chromium146.0.7680.177-2.fc44

CEF is an embeddable build of Chromium, powered by WebKit Blink...

[SECURITY] Fedora 44 Update: qt6-qtwebengine-6.10.3-1.fc44

Qt6 - QtWebEngine components...

[SECURITY] Fedora 44 Update: qt6-qtvirtualkeyboard-6.10.3-1.fc44

The Qt Virtual Keyboard project provides an input framework and reference key board frontend for Qt 6. Key features include: Customizable keyboard layouts and styles with dynamic switching. Predictive text input with word selection. Character preview and alternative character view. Automatic...

[SECURITY] Fedora 44 Update: qt6-qtsvg-6.10.3-1.fc44

Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices...

[SECURITY] Fedora 44 Update: qt6-qtgraphs-6.10.3-1.fc44

The Qt Graphs module enables you to visualize data in 3D as bar, scatter, and surface graphs. It's especially useful for visualizing depth maps and large quantities of rapidly changing data, such as data received from multiple sensors. The look and feel of graphs can be customized by using themes...

[SECURITY] Fedora 44 Update: qt6-qtgrpc-6.10.3-1.fc44

Protocol Buffers Protobuf is a cross-platform data format used to serialize structured data. gRPC provides a remote procedure call framework based on Protobuf. Qt provides tooling and classes to use these technologies...

[SECURITY] Fedora 44 Update: qt6-qtcharts-6.10.3-1.fc44

Qt Charts module provides a set of easy to use chart components. It uses the Qt Graphics View Framework, therefore charts can be easily integrated to modern user interfaces. Qt Charts can be used as QWidgets, QGra phicsWidget, or QML types. Users can easily create impressive graphs by selecting o...

[SECURITY] Fedora 44 Update: dtk6log-6.7.32-3.fc44

Simple, convenient and thread safe logger for Qt-based C++ apps...

Kratos security vulnerabilities

Kratos is a microservices governance framework developed by Yanhu individuals, built using the Go language. Kratos versions 2.9.2 and earlier contain security vulnerabilities. These vulnerabilities stem from a function in the component http.DefaultServeMux Fallback Handler, namely the function...

carton-mcp (>=0.1.80, <=0.1.83), heaven-framework (>=0.1.24, <=0.1.36) +2 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.22)

langchain-openai PYPI version 0.3.22 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - carton-mcp =0.1.80, =0.1.24, =0.1.0, =0.0.4, =0.0.6 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

EUVD-2026-25618

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public no-auth endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query string, an attacker can access any protected endpoint ...

CVE-2026-41416

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an integer overflow in media stream buffer size calculation when processing SDP with asymmetric ptime configuration. The overflow may result in an undersized buffer allocation, which can...

CVE-2026-31594

A flaw was found in the Linux kernel's PCI endpoint framework pci-epf-vntb. This vulnerability arises from a duplicate resource teardown within the epfntbepcdestroy function. A local user could potentially trigger this flaw, leading to a kernel crash and a Denial of Service DoS for the affected...

EUVD-2026-25615

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth. This vulnerability is fixed in 1.6.11...

EUVD-2026-25591

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error Denial of Service. This vulnerability is fixed in...

CVE-2026-41067

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex //g to sanitize values injected into inline tags via the define:vars directive. HTML parsers close elements case-insensitively and also accept whitespace o...

acmc (0.0.2), active-framework (>=2.0.0, <=2.0.9) +55 more potentially affected by CVE-2026-41066 via lxml (5.3.1)

lxml PYPI version 5.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - acmc 0.0.2 - active-framework =2.0.0, =25.3.0, =1.0.4, =0.0.3.dev1, =0.0.3, =0.1.0, =0.0.32, =1.7.2, =0.2.1.dev1, =0.1.0, =0.1.0, =1.0.1, =1.107.2rc3,...

CVE-2026-41067 Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex //g to sanitize values injected into inline tags via the define:vars directive. HTML parsers close elements case-insensitively and also accept whitespace o...