CLSA-2026-1786943805 TuxCare security update for org.apache.activemq (1 CVE)

TuxCare rebuilt 55 org.apache.activemq packages to address 1 CVE. Fixed in 2.37.0-tuxcare.1...

CLSA-2026-1786547487 TuxCare security update for org.springframework.pulsar (3 CVEs)

TuxCare rebuilt 6 org.springframework.pulsar packages to address 3 CVEs. Fixed in 1.2.13-tuxcare.1...

CLSA-2026-1786542819 TuxCare security update for com.mchange:mchange-commons-java (1 CVE)

TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.20-tuxcare.2...

CLSA-2026-1786540569 TuxCare security update for org.apache.avro (1 CVE)

TuxCare rebuilt 24 org.apache.avro packages to address 1 CVE. Fixed in 1.11.3-tuxcare.5...

CLSA-2026-1786423284 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 23 org.springframework packages to address 1 CVE. Fixed in 5.2.13.RELEASE-tuxcare.8...

CLSA-2026-1786379623 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.0.17-tuxcare.1...

CLSA-2026-1786379574 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 2.0.4-tuxcare.1...

CLSA-2026-1786379530 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.2-tuxcare.1...

CLSA-2026-1786361708 TuxCare security update for io.netty (1 CVE)

TuxCare rebuilt 40 io.netty packages to address 1 CVE. Fixed in 4.1.49.Final-tuxcare.2...

CVE-2024-14041

A flaw was found in Bouncy Castle for Java, affecting ML-KEM CRYSTALS-Kyber routines. Specifically, the Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines, which handle secret-derived polynomial coefficients, perform division by the modulus q. A remote attacker can exploit this...

CLSA-2026-1779151612 TuxCare security update for com.github.pjfanning:excel-streaming-reader (2 CVEs)

TuxCare rebuilt com.github.pjfanning:excel-streaming-reader to address 2 CVEs. Fixed in 5.0.2-tuxcare.1...

CLSA-2026-1777250302 TuxCare security update for org.xerial.snappy:snappy-java (1 CVE)

TuxCare rebuilt org.xerial.snappy:snappy-java to address 1 CVE. Fixed in 1.1.2-tuxcare.2...

CLSA-2026-1775521830 TuxCare security update for mysql:mysql-connector-java (1 CVE)

TuxCare rebuilt mysql:mysql-connector-java to address 1 CVE. Fixed in 5.1.49-tuxcare.1...

ae.vigilancer.android-run-app:ae.vigilancer.android-run-app.gradle.plugin (>=1.0.1, <=1.0.2), aero.m-click:mcpdf (>=0.2.3, <=0.2.10) +30638 more potentially affected by CVE-2026-58062 via org.bouncycastle:bcprov-jdk15on (>=1.46, <=1.70)

org.bouncycastle:bcprov-jdk15on MAVEN version =1.46, =1.0.1, =0.2.3, =4.4.0.0, =0.42.1, =0.1.12, =0.1.2, =0.28.0, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.3 and more Source cves: CVE-2026-58062 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519200...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2026-12803 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2026-12803 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519158...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2026-13506 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2026-13506 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519020...

UBUNTU-CVE-2026-13586

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

UBUNTU-CVE-2026-12852

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check...

UBUNTU-CVE-2026-12860

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

UBUNTU-CVE-2026-14682

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X serie...