CLSA-2026-1791052929 TuxCare security update for 11 packages (1 CVE)

TuxCare rebuilt 11 packages to address 1 CVE. Fixed in 7.18.1-tuxcare.1...

CLSA-2026-1791052887 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 18 @angular packages to address 1 CVE. Fixed in 8.2.14-tuxcare.14...

CLSA-2026-1791051933 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 16 @angular packages to address 1 CVE. Fixed in 11.2.11-tuxcare.7...

CLSA-2026-1791049554 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 18 @angular packages to address 1 CVE. Fixed in 7.2.11-tuxcare.6...

CLSA-2026-1791048306 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 18 @angular packages to address 1 CVE. Fixed in 7.2.16-tuxcare.13...

CLSA-2026-1791047714 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 19 @angular packages to address 1 CVE. Fixed in 9.1.13-tuxcare.16...

CLSA-2026-1791045476 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 18 @angular packages to address 1 CVE. Fixed in 7.2.0-tuxcare.5...

CLSA-2026-1791042545 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 5.2.11-tuxcare.22...

CLSA-2026-1791030849 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 16 @angular packages to address 1 CVE. Fixed in 16.2.11-tuxcare.6...

CLSA-2026-1791028079 TuxCare security update for undici (11 CVEs)

TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2...

CLSA-2026-1791028047 TuxCare security update for probe-image-size (1 CVE)

TuxCare rebuilt probe-image-size to address 1 CVE. Fixed in 7.3.0-tuxcare.1...

CLSA-2026-1791028032 TuxCare security update for minimatch (2 CVEs)

TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.4.0-tuxcare.2...

[SECURITY] Fedora 45 Update: transactional-update-6.0.6-4.fc45

transactional-update is a tool to update a system in an atomic way with btrfs and snapshots...

[SECURITY] Fedora 45 Update: mstflint-4.36.0-4.fc45

This package contains firmware update tool, vpd dump and register dump tools for network adapters based on Mellanox Technologies chips...

EUVD-2026-91851

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

CVE-2026-104475

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

CVE-2026-104474

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...

CVE-2026-104475: Improper Neutralization of Input During Web Page Generation

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...

CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...