CLSA-2026-1786346242 TuxCare security update for guzzlehttp/psr7 (1 CVE)

TuxCare rebuilt guzzlehttp/psr7 to address 1 CVE. Fixed in 1.9.1-p2+tuxcare...

CLSA-2026-1784682900 TuxCare security update for twig/twig (1 CVE)

TuxCare rebuilt twig/twig to address 1 CVE. Fixed in v2.16.1-p2+tuxcare...

CLSA-2026-1784250517 TuxCare security update for symfony/yaml (1 CVE)

TuxCare rebuilt symfony/yaml to address 1 CVE. Fixed in v3.4.47-p2+tuxcare...

CLSA-2026-1771894652 TuxCare security update for symfony/process (1 CVE)

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p2+tuxcare...

CLSA-2026-1777855982 TuxCare security update for zendframework/zendframework1 (7 CVEs)

TuxCare rebuilt zendframework/zendframework1 to address 7 CVEs. Fixed in 1.12.10-p2+tuxcare...

CLSA-2026-1771289503 TuxCare security update for spatie/browsershot (1 CVE)

TuxCare rebuilt spatie/browsershot to address 1 CVE. Fixed in 3.61.0-p2+tuxcare...

CLSA-2026-1779410885 TuxCare security update for phpseclib/phpseclib (1 CVE)

TuxCare rebuilt phpseclib/phpseclib to address 1 CVE. Fixed in 0.3.10-p2+tuxcare...

CLSA-2026-1774399515 TuxCare security update for symfony/http-foundation (1 CVE)

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in 4.4.49-p2+tuxcare...

CLSA-2026-1778201069 TuxCare security update for drupal/core (1 CVE)

TuxCare rebuilt drupal/core to address 1 CVE. Fixed in 9.5.11-p2+tuxcare...

Malicious code in @antv/li-p2 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

CVE-2026-30496

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration 74 endpoints and writing/modifying settings including volume, mute,...

EUVD-2026-28366

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes Android Debug Bridge ADB on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binar...

EUVD-2026-28367

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration 74 endpoints and writing/modifying settings including volume, mute,...

CVE-2026-30496

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration 74 endpoints and writing/modifying settings including volume, mute,...

CVE-2026-30495

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes Android Debug Bridge ADB on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binar...

CVE-2026-30495

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes Android Debug Bridge ADB on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binar...

CVE-2026-30495

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes Android Debug Bridge ADB on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binar...

CVE-2026-30495

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01 , Android 8.0.0) is vulnerable to unauthorized access because it exposes the Android Debug Bridge (ADB) on TCP port 5555 without authentication. The security risk is heightened because the device is configured with ro.adb.secure=0, di...

CVE-2026-30496

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration 74 endpoints and writing/modifying settings including volume, mute,...

CVE-2026-30495

The Optoma CinemaX P2 projector firmware TVOS-04.24.010.04.01, Android 8.0.0 exposes Android Debug Bridge ADB on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binar...