472945 matches found
CLSA-2026-1791045476 TuxCare security update for @angular (1 CVE)
TuxCare rebuilt 18 @angular packages to address 1 CVE. Fixed in 7.2.0-tuxcare.5...
CLSA-2026-1791042545 TuxCare security update for @angular (1 CVE)
TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 5.2.11-tuxcare.22...
CLSA-2026-1791030849 TuxCare security update for @angular (1 CVE)
TuxCare rebuilt 16 @angular packages to address 1 CVE. Fixed in 16.2.11-tuxcare.6...
CLSA-2026-1791028079 TuxCare security update for undici (11 CVEs)
TuxCare rebuilt undici to address 11 CVEs. Fixed in 6.19.5-tuxcare.2...
CLSA-2026-1791028047 TuxCare security update for probe-image-size (1 CVE)
TuxCare rebuilt probe-image-size to address 1 CVE. Fixed in 7.3.0-tuxcare.1...
CLSA-2026-1791028032 TuxCare security update for minimatch (2 CVEs)
TuxCare rebuilt minimatch to address 2 CVEs. Fixed in 0.4.0-tuxcare.2...
[SECURITY] Fedora 45 Update: transactional-update-6.0.6-4.fc45
transactional-update is a tool to update a system in an atomic way with btrfs and snapshots...
[SECURITY] Fedora 45 Update: mstflint-4.36.0-4.fc45
This package contains firmware update tool, vpd dump and register dump tools for network adapters based on Mellanox Technologies chips...
EUVD-2026-91851
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104474
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction...
CVE-2026-104475
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475: Improper Neutralization of Input During Web Page Generation
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475 IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browser...
CVE-2026-104475
IDURAR ERP CRM, versions through 4.1.1 , is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the application's failure to sanitize SVG files during the upload process. Authenticated users can exploit this by uploading JavaScript-laden SVGs via the profile update or settin...
CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...
CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...
CVE-2026-104873
The LangGraph Python SDK is vulnerable to an authorization bypass in versions 0.1.45 through 0.4.3 . The root cause is that resource-scoped authorization decorators (@auth.on.threads , @auth.on.assistants , and @auth.on.crons ) ignore the actions argument, registering handlers for every action on...