CLSA-2026-1792432136 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

CLSA-2026-1792432139 TuxCare security update for @babel/plugin-transform-spread (1 CVE)

TuxCare rebuilt @babel/plugin-transform-spread to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

CVE-2026-19854

A flaw was found in the Grafana ClickHouse plugin. When using the Native protocol with PDC or secure SOCKS, the connection library fails to enforce Transport Layer Security TLS, causing sensitive data such as usernames, passwords, queries, and results to be transmitted in cleartext. This allows a...

CLSA-2026-1792427001 TuxCare security update for @babel/plugin-transform-sticky-regex (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

CLSA-2026-1792427002 TuxCare security update for @babel/plugin-transform-sticky-regex (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792427003 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

CLSA-2026-1792427000 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792426999 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

CLSA-2026-1792426995 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792426996 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792426994 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

CLSA-2026-1792426991 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

CLSA-2026-1792426993 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

CLSA-2026-1792426992 TuxCare security update for @babel/plugin-transform-sticky-regex (1 CVE)

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

CVE-2026-112306

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

Arizu Fast Tunnel permission permissions and access control issues

Arizu Fast Tunnel 1.0.0 version has a security vulnerability. This vulnerability stems from the improper handling of the pluginfile parameter in the ZipArchive::extractTo function within the Plugin Installer component. It may lead to unlimited file uploads...

TYPO3: Coding.ms authorization issue vulnerability

TYPO3: There are authorization issues with versions of TYPO3 between 6.0.0 and 6.3.0, 5.0.0 and 5.21.1, and 4.9.4. This issue arises because the order cancellation function accepts order identifiers from requests, but does not verify whether the caller has permission to cancel that order. As a...

Vite information leakage vulnerability

Vite versions from 8.3.0 to 8.3.3 and from 8.2.0 to 8.2.4, as well as vite-plus version 0.2.8 to 1.1.0, have security vulnerabilities. The vulnerability stems from the Wasm plugin load hook not applying the server.fs check. When processing requests containing the?vite-wasm-instance query, the...

FlexGet path traversal vulnerability

Versions of FlexGet prior to 3.20.7 have a path traversal vulnerability. This vulnerability stems from the decompress plugin, which has a path traversal flaw. Attackers can use feeds that contain zip or rar archives with "../ sequences or absolute paths" to write arbitrary files. This may result ...

Oracle MySQL Server security vulnerabilities

A security vulnerability exists in Oracle MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1; as well as in Oracle MySQL Cluster versions 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. This vulnerability stems fr...