CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2026:1770647876)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1770647876 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus h...

@asermax/tachikoma (>=3.67.0, <=3.81.0), @dgtalbug/iris (>=0.3.0-rc.0, <=0.4.0) +35 more potentially affected by unknown CVE via markdown-it (15.0.0)

markdown-it NPM version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it and may be impacted: - @asermax/tachikoma =3.67.0, =0.3.0-rc.0, =0.0.12, =0.0.5, =0.16.4, =0.11.4, =0.11.6 and more Source cves: unknown CVE Source advisory:...

@asermax/tachikoma (>=3.67.0, <=3.81.0), @dgtalbug/iris (>=0.3.0-rc.0, <=0.4.0) +35 more potentially affected by unknown CVE via markdown-it (15.0.0)

markdown-it NPM version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it and may be impacted: - @asermax/tachikoma =3.67.0, =0.3.0-rc.0, =0.0.12, =0.0.5, =0.16.4, =0.11.4, =0.11.6 and more Source cves: unknown CVE Source advisory:...

@0xwork/connect (>=0.1.8, <=0.1.9), @7n/rules (>=1.0.0, <=1.118.11) +528 more potentially affected by unknown CVE via markdown-it (>=14.0.0, <=14.3.0)

markdown-it NPM version =14.0.0, =0.1.8, =1.0.0, =2026.6.2, =4.10.0, =2026.5.2-zh, =1.0.0, =5.52.1-fa.2, =5.52.1-fa.2, =2.3.0, =2.24.0 - @amap-lbs/amap-a2ui 0.1.0 - @apilium/mayros-matrix 0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-253C-MCHW-3W2R...

@1-click/shared-lib (0.0.1), @20206205tech/nestjs-auth (>=1.0.0, <=1.4.1) +871 more potentially affected by unknown CVE via js-yaml (>=5.0.0, <=5.4.0)

js-yaml NPM version =5.0.0, =1.0.0, =0.3.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =1.1.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =2.2.73 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R3PH-W7GJ-G6XM...

Server-generated Error Message Containing Sensitive Information

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Server-generated Error Message Containing Sensitive Information via the server-side RPC error handler in server.ts, which unconditionally includes the raw exception message in the gRPC status...

@gudman/charter-conformance (0.1.0), @gudman/charter-core (0.1.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (0.5.1)

@openzeppelin/confidential-contracts NPM version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/confidential-contracts and may be impacted: - @gudman/charter-conformance 0.1.0 - @gudman/charter-core 0.1.0 -...

@raycashxyz/confidential-primitives (>=0.1.0, <=0.1.1), @zentity/contracts (>=0.6.0, <=0.7.0) +1 more potentially affected by unknown CVE via @openzeppelin/confidential-contracts (>=0.3.0, <=0.3.1)

@openzeppelin/confidential-contracts NPM version =0.3.0, =0.1.0, =0.6.0, =0.1.0, =0.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-OPENZEPPELINCONFIDENTIALCONTRACTS-20158601...

aquatic (0.2.0), aquatic_http (0.2.0) +159 more potentially affected by unknown CVE via owned-alloc (0.2.0)

owned-alloc CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on owned-alloc and may be impacted: - aquatic 0.2.0 - aquatichttp 0.2.0 - aquatichttploadtest 0.2.0 - aquaticws 0.2.0 - aquaticwsloadtest 0.2.0 - asyncexecutors =0.6.0, =1.0.0...

CVE-2026-47321

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...

a3mo_lib (>=0.1.0, <=0.1.1), android-abx (0.1.0) +199 more potentially affected by unknown CVE via faster-hex (>=0.3.1, <=0.10.0)

faster-hex CARGO version =0.3.1, =0.1.0, =4.0.0, =0.19.7, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.101.0, =0.37.0-pre, =0.119.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0306...

SUSE CVE-2024-51745

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...

SUSE CVE-2026-21714

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 connection-level that cause the flow control window to exceed the maximum value of 2^31-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This...

OSV-2026-1297 UNKNOWN READ in janet_to_string_b

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=562551214 Crash type: UNKNOWN READ Crash state: janettostringb janetformatbv janetpanicf...

PT-2026-99753

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=562551214 Crash type: UNKNOWN READ Crash state: janet to string b janet formatbv janet panicf...

CVE-2026-73638

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...

UBUNTU-CVE-2026-73639

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in readdirect8. With a tRNS chunk, readdirect8 adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count...

CVE-2026-73639

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in readdirect8. With a tRNS chunk, readdirect8 adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count...

CVE-2026-54604

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and openslidetiffreadtile to request a full-height destination for a partial bottom tile row, allowing uninitialized...

CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parselevel0xml processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memo...