CLSA-2026-1789465375 TuxCare security update for launch-editor (2 CVEs)

TuxCare rebuilt launch-editor to address 2 CVEs. Fixed in 2.2.1-tuxcare.1...

CVE-2026-84766

Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...

CVE-2026-72843

EverShop 's updateCustomer route (packages/evershop/src/modules/customer/api/updateCustomer/route.json) is declared "access": "public", so the admin auth middleware calls next() without verifying the caller and no session guard protects the route. The handler in updateCustomer.js loads a customer...

CLSA-2026-1784769544 TuxCare security update for protobufjs (8 CVEs)

TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1776731779 TuxCare security update for useragent (1 CVE)

TuxCare rebuilt useragent to address 1 CVE. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1775003175 TuxCare security update for underscore.string (1 CVE)

TuxCare rebuilt underscore.string to address 1 CVE. Fixed in 2.2.1-tuxcare.1...

CVE-2026-14834 Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists...

CLEANSTART-2026-GJ23876 Security fixes in cosign 2.2.1-r0

Package cosign version 2.2.1-r0 fixes 1 vulnerabilities: CVE-2023-46737...

CLEANSTART-2026-AR50437 Security fixes in spark-operator 2.2.1-r4

Package spark-operator version 2.2.1-r4 fixes 11 vulnerabilities: CVE-2026-39817, CVE-2026-39820, CVE-2026-39826, CVE-2026-39823, CVE-2026-42499...

CVE-2026-54635

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...

CVE-2026-54635 pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...

CVE-2026-54635 pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...

CVE-2026-54635 pytonapi has a Webhook Custom Path Authentication Bypass

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...

EUVD-2026-46410

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

[SECURITY] Fedora 43 Update: ansible-collection-ansible-posix-2.2.1-1.fc43

Ansible Collection targeting POSIX and POSIX-ish platforms...

Fedora 44 : ansible-collection-ansible-posix (2026-0f941ecaa6)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0f941ecaa6 advisory. - Update to 2.2.1. Fixes rhbz2479556. - Mitigates CVE-2026-11837 rhbz2487430, rhbz2487431, rhbz2487432 Tenable has extracted the preceding descripti...

CVE-2026-55865

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

CVE-2026-55865

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

CVE-2026-9756

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...