CLSA-2026-1790475892 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 16.2.11-tuxcare.4...

CLSA-2026-1790466289 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 6 @angular packages to address 3 CVEs. Fixed in 6.0.1-tuxcare.6...

CLSA-2026-1790460862 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 6 @angular packages to address 3 CVEs. Fixed in 5.1.0-tuxcare.6...

CLSA-2026-1790454526 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 13.3.12-tuxcare.6...

CLSA-2026-1790450474 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 13.4.0-tuxcare.11...

DEBIAN-CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100670

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CLSA-2026-1790431292 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 5 @angular packages to address 1 CVE. Fixed in 10.1.0-tuxcare.7...

CVE-2026-100689

A flaw was found in GitPython. When updating submodules, GitPython fails to properly validate the submodule path specified in a repository's configuration file. A remote attacker could exploit this vulnerability by supplying a crafted repository containing directory traversal sequences in the...

CVE-2026-100689

GitPython before 3.1.62 does not validate the "path" field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the "name" field, and GitPython's own containment guard Submodule.torelativepath is applied...

CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

EUVD-2026-87764

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CVE-2026-100670

Grav CMS versions 2.0.14 through 2.0.24 are vulnerable to a privilege escalation vulnerability within the group and account blueprints. The root cause is a flaw where the access map guard (e.g., security@: admin.super) resolves by exact path; consequently, a flat dot-notation key like access.admi...

CVE-2026-100670

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a "security@: admin.super" guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as "access.admin.super" instead of th...

CVE-2026-100613

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the "transferapp" database function transfers an app, its channels, versions and related records to a destination organization...

CVE-2026-100613 capgo.app Authorization Bypass via Stale Channel Permission Overrides

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

EUVD-2026-87708

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: The reuseport cBPF prog is freed after the RCU grace period. Eulgyu Kim reported the issue below with a reproduction example. The reproduction example sets up a UDP reuseport group with a cBPF prog and replaces it with a new...

CVE-2026-96532 Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...

CVE-2026-96532 Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...