CVE-2026-59887 vulnerabilities

Vulnerabilities for packages: argo-workflows...

PT-2026-93327

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.9 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An authenticated user with developer-role permissions can substitute package file content and hide packag...

CLSA-2026-1789478968 TuxCare security update for 11 packages (1 CVE)

TuxCare rebuilt 11 packages to address 1 CVE. Fixed in 4.0.18-tuxcare.1...

CLSA-2026-1789477857 TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 2.2.6-tuxcare.1...

CLSA-2026-1789473405 TuxCare security update for 23 packages (1 CVE)

TuxCare rebuilt 23 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.4...

CLSA-2026-1789467187 TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 9.20.3-tuxcare.1...

CVE-2026-56830: Missing Authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-55617: Insufficient Session Expiration

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CLSA-2026-1789414950 TuxCare security update for 82 packages (3 CVEs)

TuxCare rebuilt 82 packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3...

⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination. The rest of the week is more familiar: old bugs still working, fresh exploit chains...

Important: Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - ffmpeg

AIPCC Security Alerts identified CVEs in the 3.5 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...

Astra Linux – Vulnerability in dpkg

In dpkg, the Debian package management system, versions prior to 1.21.8, 1.20.10, 1.19.8, and 1.18.26 are vulnerable to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include debian.tar, the in-place extraction process may...

CLSA-2026-1789376980 TuxCare security update for 13 packages (1 CVE)

TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 6.0.17.Final-tuxcare.1...

CLSA-2026-1789372923 TuxCare security update for io.undertow (1 CVE)

TuxCare rebuilt 7 io.undertow packages to address 1 CVE. Fixed in 1.4.27.Final-tuxcare.1...

CLSA-2026-1789369705 TuxCare security update for org.apache.httpcomponents.core5 (2 CVEs)

TuxCare rebuilt 5 org.apache.httpcomponents.core5 packages to address 2 CVEs. Fixed in 5.2.4-tuxcare.1...

RHEL 9 : RHEL AI 3.3 RPM runtime CVE fix - ffmpeg (Important) (RHSA-2026:67276)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67276 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

CVE-2026-49250: Inefficient Algorithmic Complexity

Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.property. From 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An...

RHEL 8 : osbuild-composer (RHSA-2026:67148)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67148 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

Fedora 44 : rust-hickory-net / rust-hickory-proto / rust-hickory-resolver (2026-3c1acd5a65)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-3c1acd5a65 advisory. Update hickory-dns crates to version 0.26.2. This includes fixes for a large number of security relevant bugs. Release notes:...