PT-2026-99043

TuxCare rebuilt 14 packages to address 1 CVE. Fixed in 14.2.35-tuxcare.9...

CLSA-2026-1789414950 TuxCare security update for 82 packages (3 CVEs)

TuxCare rebuilt 82 packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3...

⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination. The rest of the week is more familiar: old bugs still working, fresh exploit chains...

Important: Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - ffmpeg

AIPCC Security Alerts identified CVEs in the 3.5 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...

Astra Linux – Vulnerability in dpkg

In dpkg, the Debian package management system, versions prior to 1.21.8, 1.20.10, 1.19.8, and 1.18.26 are vulnerable to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include debian.tar, the in-place extraction process may...

CLSA-2026-1789376980 TuxCare security update for 13 packages (1 CVE)

TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 6.0.17.Final-tuxcare.1...

CLSA-2026-1789372923 TuxCare security update for io.undertow (1 CVE)

TuxCare rebuilt 7 io.undertow packages to address 1 CVE. Fixed in 1.4.27.Final-tuxcare.1...

CLSA-2026-1789369705 TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)

TuxCare rebuilt 5 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.2.4-tuxcare.1...

RHEL 9 : RHEL AI 3.3 RPM runtime CVE fix - ffmpeg (Important) (RHSA-2026:67276)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67276 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

RHEL 8 : osbuild-composer (RHSA-2026:67148)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67148 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

CVE-2026-49250: Inefficient Algorithmic Complexity

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

Fedora 44 : rust-hickory-net / rust-hickory-proto / rust-hickory-resolver (2026-3c1acd5a65)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-3c1acd5a65 advisory. Update hickory-dns crates to version 0.26.2. This includes fixes for a large number of security relevant bugs. Release notes:...

CLSA-2026-1789228568 TuxCare security update for io.netty (2 CVEs)

TuxCare rebuilt 47 io.netty packages to address 2 CVEs. Fixed in 4.1.119.Final-tuxcare.3...

CLSA-2026-1789219941 TuxCare security update for io.netty (1 CVE)

TuxCare rebuilt 47 io.netty packages to address 1 CVE. Fixed in 4.1.117.Final-tuxcare.4...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

EUVD-2026-76767

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CLSA-2026-1789159895 TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 6.30.3-tuxcare.2...

CLSA-2026-1789159265 TuxCare security update for 123 packages (1 CVE)

TuxCare rebuilt 123 packages to address 1 CVE. Fixed in 11.0.31.tuxcare0001...

GHSA-7JXH-36Q5-GCQV vulnerabilities

Vulnerabilities for packages: manifest-tool, kube-mgmt-fips, kubescape, cloudbeat, kube-mgmt, packer, trivy-operator, helm-mapkubeapis, buildkitd-fips, kaniko, helm-set-status, datadog-agent-fips, docker-cli-buildx, chaos-mesh-fips, syft-fips, helm-push, redpanda-operator, crossplane-cli-fips,...