CLSA-2026-1790542520 TuxCare security update for undici (1 CVE)

TuxCare rebuilt undici to address 1 CVE. Fixed in 7.28.0-tuxcare.1...

CLSA-2026-1790541935 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.17.1-tuxcare.1...

CLSA-2026-1790541933 TuxCare security update for qs (2 CVEs)

TuxCare rebuilt qs to address 2 CVEs. Fixed in 6.15.3-tuxcare.1...

CLSA-2026-1790520250 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.1...

CLSA-2026-1790482357 TuxCare security update for @angular (2 CVEs)

TuxCare rebuilt 19 @angular packages to address 2 CVEs. Fixed in 7.2.1-tuxcare.5...

CLSA-2026-1790475892 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 17 @angular packages to address 4 CVEs. Fixed in 16.2.11-tuxcare.4...

CLSA-2026-1790466289 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 19 @angular packages to address 3 CVEs. Fixed in 6.0.1-tuxcare.6...

CLSA-2026-1790460862 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 18 @angular packages to address 3 CVEs. Fixed in 5.1.0-tuxcare.6...

CLSA-2026-1790454526 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 17 @angular packages to address 3 CVEs. Fixed in 13.3.12-tuxcare.6...

CLSA-2026-1790450474 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 17 @angular packages to address 3 CVEs. Fixed in 13.4.0-tuxcare.11...

DEBIAN-CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100670

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CLSA-2026-1790431292 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 19 @angular packages to address 3 CVEs. Fixed in 10.1.0-tuxcare.7...

CVE-2026-100689

A flaw was found in GitPython. When updating submodules, GitPython fails to properly validate the submodule path specified in a repository's configuration file. A remote attacker could exploit this vulnerability by supplying a crafted repository containing directory traversal sequences in the...

CVE-2026-100689

GitPython before 3.1.62 does not validate the "path" field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the "name" field, and GitPython's own containment guard Submodule.torelativepath is applied...

CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CVE-2026-100670

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a "security@: admin.super" guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as "access.admin.super" instead of th...

CVE-2026-100670

Grav CMS versions 2.0.14 through 2.0.24 are vulnerable to a privilege escalation vulnerability within the group and account blueprints. The root cause is a flaw where the access map guard (e.g., security@: admin.super) resolves by exact path; consequently, a flat dot-notation key like access.admi...

EUVD-2026-87764

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

EUVD-2026-87708

capgo.app is an over-the-air OTA update platform for Capacitor apps. In all versions up to and including the current release no patch available at time of publication, the transferapp database function transfers an app, its channels, versions and related records to a destination organization...