CLSA-2026-1789484066 TuxCare security update for 13 packages (1 CVE)

TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 14.2.35-tuxcare.9...

CLSA-2026-1789479340 TuxCare security update for 2 packages (2 CVEs)

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 0.7.4-tuxcare.1...

CLSA-2026-1789478968 TuxCare security update for vitest (1 CVE)

TuxCare rebuilt vitest to address 1 CVE. Fixed in 4.0.18-tuxcare.1...

ROOT-APP-NPM-CVE-2026-44240 CVE-2026-44240 in basic-ftp - Patched by Root

Root has patched CVE-2026-44240 in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-4367 CVE-2024-4367 in pdfjs-dist - Patched by Root

Root has patched CVE-2024-4367 in the pdfjs-dist package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-35523 CVE-2026-35523 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-35523 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1789461261 TuxCare security update for 22 packages (1 CVE)

TuxCare rebuilt 22 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.9...

CLSA-2026-1789461217 TuxCare security update for net.minidev (1 CVE)

TuxCare rebuilt 3 net.minidev packages to address 1 CVE. Fixed in 2.5.1-tuxcare.1...

ROOT-APP-NPM-CVE-2026-50272 CVE-2026-50272 in dd-trace - Patched by Root

Root has patched CVE-2026-50272 in the dd-trace package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-RA54974 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Multiple security vulnerabilities affect the npm package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual...

CLEANSTART-2026-NR05292 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the metallb package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-BW73838 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the helm package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

[SECURITY] Fedora 43 Update: perl-DBI-1.653-1.fc43

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used...

[SECURITY] Fedora 44 Update: perl-Protocol-HTTP2-1.14-1.fc44

Protocol::HTTP2 is Perl HTTP/2 protocol implementation RFC 7540 with stateful decoders/encoders of HTTP/2 frames. You may use this module to implement your own HTTP/2 client/server/intermediate on top of your favorite event loop over plain or TLS socket...

[SECURITY] Fedora 45 Update: perl-DBI-1.653-1.fc45

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used...

[SECURITY] Fedora 45 Update: perl-Data-Entropy-0.010-1.fc45

This module maintains a concept of a current selection of entropy source. Algorithms that require entropy, such as those in Data::Entropy::Algorithms, can use the source nominated by this module, avoiding the need for entropy source objects to be explicitly passed around. This is convenient becau...

[SECURITY] Fedora 45 Update: perl-Protocol-HTTP2-1.14-1.fc45

Protocol::HTTP2 is Perl HTTP/2 protocol implementation RFC 7540 with stateful decoders/encoders of HTTP/2 frames. You may use this module to implement your own HTTP/2 client/server/intermediate on top of your favorite event loop over plain or TLS socket...

CVE-2026-57012: Protection Mechanism Failure

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-79705: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

PT-2026-92051

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4 Description An issue in the Custom MCP node allows authenticated attackers to achieve remote code execution. By supplying malicious npx package names through the mcpServerConfig parameter, an attacker can force...