CLSA-2025-1761696690 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post6+tuxcare...

CLSA-2026-1772496669 TuxCare security update for pymongo (1 CVE)

TuxCare rebuilt pymongo to address 1 CVE. Fixed in 3.13.0.post1+tuxcare...

CLSA-2026-1772410250 TuxCare security update for flask (1 CVE)

TuxCare rebuilt flask to address 1 CVE. Fixed in 1.1.2.post1+tuxcare...

CLSA-2025-1756426301 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.post1+tuxcare...

CLSA-2026-1772496679 TuxCare security update for requests (1 CVE)

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.25.1.post1+tuxcare...

CLSA-2026-1767658110 TuxCare security update for 89 packages (3 CVEs)

TuxCare rebuilt 89 packages to address 3 CVEs. Fixed in 9.4.24.v20191120-tuxcare.1...

CLSA-2025-1765411679 TuxCare security update for 35 packages (2 CVEs)

TuxCare rebuilt 35 packages to address 2 CVEs. Fixed in 8.5.100-tuxcare.4...

CLSA-2025-1763597253 TuxCare security update for 88 packages (2 CVEs)

TuxCare rebuilt 88 packages to address 2 CVEs. Fixed in 9.4.53.v20231009-tuxcare.1...

CLSA-2025-1761523598 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.39-tuxcare.9...

CLSA-2025-1759795580 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.21-tuxcare.1...

CLSA-2025-1761005194 TuxCare security update for 35 packages (1 CVE)

TuxCare rebuilt 35 packages to address 1 CVE. Fixed in 8.5.100-tuxcare.3...

AIOHTTP: HTTP request smuggling via WebSocket upgrade

SummaryThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ImpactIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware ...

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Summaryconsultgeminiwithfiles in inline mode read any file path supplied inthe files argument without confining it to the working directory, thenforwarded the contents to the Gemini CLI. Because the caller also controlsquery, the file contents are echoed back through the Gemini round-tripand sent...

PYSEC-2026-3574 gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

Summary consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip and...

linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

Summarylib.url.fetch follows HTTP redirects followredirects=True. httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header a session token such as Redfish's X-Auth-Token, an API key, ... was still sent to the redirect target. A...

OPENSUSE-SU-2026:11444-1 azure-storage-azcopy-10.32.6-1.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.6-1.1 package on the GA media of openSUSE Tumbleweed...

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

A Cross-Site Scripting XSS vulnerability has been identified in the Angular compiler's internationalization i18n pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation validateAttribute / validateProperty, the i18...

CVE-2026-18248 @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that...

ROOT-APP-PYPI-CVE-2026-28490 CVE-2026-28490 in Authlib - Patched by Root

Root has patched CVE-2026-28490 in the Authlib package for Root:PyPI. Multiple fixed versions available...

JLSEC-2026-1101

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-unit offsets using unitoffset + unitsize. Because the addition can wrap, a crafted HEIF file can pass the range check and then construct a vector...