CLSA-2026-1787224839 TuxCare security update for bootstrap (12 CVEs)

TuxCare rebuilt bootstrap to address 12 CVEs. Fixed in 3.3.2-tuxcare.1...

CVE-2026-76070

creationtimestamp| type| source ---|---|--- 2026-08-20 05:00:03+00:00| published-proof-of-concept| Telegram/XofvqRV5hkEKine-AqSThWE3tYrgZQJPu8IyHlpngfjWOA 2026-08-21 00:00:10+00:00| published-proof-of-concept| Telegram/XofvqRV5hkEKine-AqSThWE3tYrgZQJPu8IyHlpngfjWOA 2026-08-22 19:00:05+00:00| seen...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-glue, crossplane-provider-aws-fis-fips, crossplane-provider-aws-datapipeline-fips, crossplane-provider-aws-opensearchserverless, crossplane, kubevela-fips, crossplane-provider-azure-purview, crossplane-provider-aws-signer-fips, frankenphp-8.3,...

CVE-2025-36254

creationtimestamp| type| source ---|---|--- 2026-08-20 01:44:27+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mti4ojymxa2n...

CVE-2026-76886

creationtimestamp| type| source ---|---|--- 2026-08-20 01:04:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mti2h7jbye27 2026-08-24 17:00:04+00:00| seen| https://t.me/bdufstecru/3404 2026-08-25 00:00:22+00:00| seen| https://t.me/bdufstecru/3404 2026-09-03 22:35:01+00:00|...

PT-2026-79045

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An issue exists where StreamSource performs no authorization check, allowing any authenticated user to logically delete all stream sources. Recommendations Upgrade to version 2.4.0...

PT-2026-79061

Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions prior to 1.122.25 VictoriaMetrics versions prior to 1.136.12 VictoriaMetrics versions prior to 1.146.0 Description The vmrestore tool fails to validate backup part path components before writing restored data below...

PT-2026-79144

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.3 Description Applications that define unusual custom sources and process untrusted uncompressed PPM images can trigger a max/min error in the vips source read to memory function within libvips/iofuncs/source.c...

BuildKit has a possible runtime DoS via unbounded group parsing

Impact Maliciously crafted base image or build can cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory OOM kill of the buildkitd process. Patches Issue is fixed in BuildKit v0.31.1+ Workarounds Use trusted build...

CVE-2026-18315

creationtimestamp| type| source ---|---|--- 2026-08-19 20:11:57+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthk3xuqgd2u 2026-08-20 00:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthz3giigf2u 2026-08-21 00:00:08+00:00| published-proof-of-concept|...

CVE-2026-71866

creationtimestamp| type| source ---|---|--- 2026-08-19 20:10:33+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthjzhs6lx2e 2026-08-20 00:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthxfrxthy25 2026-09-02 16:35:20+00:00| published-proof-of-concept|...

CVE-2026-75593 BuildKit: Malicious client can bypass destination directory validation on local sources upload

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

CVE-2026-22306 Critical flaw impacting OZOLS ERP's automatic update channel

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel...

CVE-2026-52792

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

AZL-97014 CVE-2026-48711 affecting package fuse-sshfs 3.7.3-1

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...

ALPINE-CVE-2026-48711

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...

CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792

Algernon (a pure-Go web server) prior to 1.17.9 is vulnerable to server-side script source disclosure on Windows via NTFS filename aliasing. The root cause is in engine/handlers.go: filepath.Ext() does not recognize NTFS-equivalent suffixes (::$DATA, trailing dot, trailing space) as the script ex...

CVE-2026-48711

SSHFS (a network filesystem client for SSH) is vulnerable to argument injection in its find_base_path() function. From version 1.4 through 3.7.5, a bracketed mount source such as [-oProxyCommand=CMD]:/path has its brackets stripped, leaving a host value beginning with - that is passed directly to...