CLSA-2026-1775781159 TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 23 org.springframework packages to address 3 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.3...

CLSA-2026-1777249675 TuxCare security update for 2 packages (4 CVEs)

TuxCare rebuilt 2 packages to address 4 CVEs. Fixed in 5.4.14-tuxcare.2...

CLSA-2026-1774225210 TuxCare security update for ssri (1 CVE)

TuxCare rebuilt ssri to address 1 CVE. Fixed in 5.3.0-tuxcare.1...

CLSA-2026-1773965919 TuxCare security update for cross-spawn (1 CVE)

TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 5.1.0-tuxcare.1...

CLSA-2026-1773101691 TuxCare security update for qs (3 CVEs)

TuxCare rebuilt qs to address 3 CVEs. Fixed in 5.1.0-tuxcare.1...

CLSA-2025-1766534902 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.27-tuxcare.2...

CVE-2026-67199

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

Important: gawk

Issue Overview: Use After Free vulnerability has been found in "io.c" program file of gawk dogetlineredir routine. This issue may lead to a crash. It affects gawk in versions 5.4.0 and below. CVE-2026-40467 Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This...

WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by whitebyte in WordPress Plugin Church Admin versions = 5.0.30...

CVE-2026-69093

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

CVE-2026-9335

CVE-2026-9335 concerns keras-team/keras ≤ 3.14.0, where improper handling of HDF5 ExternalLinks in ExternalLink resolution allows arbitrary local HDF5 file content disclosure. The vulnerability arises because KerasFileEditor and keras.saving.load_weights bypass safe_get_h5_group and safe_get_h5_d...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

EUVD-2026-51596

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

PT-2026-66745

Name of the Vulnerable Software and Affected Versions Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2 Description HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager when it encounters an invalid or unsupport...

RHSA-2026:48225 Red Hat Security Advisory: perl:5.32 security update

Bulletin has no description...

CLEANSTART-2026-XF79120 Security fixes in minio-operator-fips 5.0.18-r7

Package minio-operator-fips version 5.0.18-r7 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-HJ28127 Security fixes in redis 5.0.4-r0

Package redis version 5.0.4-r0 fixes 2 vulnerabilities: CVE-2019-10192, CVE-2019-10193...

CLEANSTART-2026-ZD86302 Security fixes in neuvector-fips 5.4.8-r0

Package neuvector-fips version 5.4.8-r0 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

WordPress BookingPress Pro plugin < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering vulnerability

Unauthenticated Customer PII Disclosure and Booking Tampering vulnerability discovered by Kolja Zuelsdorf in WordPress Plugin BookingPress Appointment Booking Pro versions 5.7.3...

EUVD-2026-50957

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to...