CLSA-2026-1780361390 TuxCare security update for diff (5 CVEs)

TuxCare rebuilt diff to address 5 CVEs. Fixed in 5.0.0-tuxcare.1...

CLSA-2026-1777509598 TuxCare security update for immutable (2 CVEs)

TuxCare rebuilt immutable to address 2 CVEs. Fixed in 5.0.3-tuxcare.1...

CLSA-2025-1766534902 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.27-tuxcare.2...

CVE-2026-67199

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CVE-2026-69093

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

CVE-2026-9335

CVE-2026-9335 concerns keras-team/keras ≤ 3.14.0, where improper handling of HDF5 ExternalLinks in ExternalLink resolution allows arbitrary local HDF5 file content disclosure. The vulnerability arises because KerasFileEditor and keras.saving.load_weights bypass safe_get_h5_group and safe_get_h5_d...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

EUVD-2026-51596

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

PT-2026-66745

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

RHSA-2026:48225 Red Hat Security Advisory: perl:5.32 security update

Bulletin has no description...

CLEANSTART-2026-ZD86302 Security fixes in neuvector-fips 5.4.8-r0

Package neuvector-fips version 5.4.8-r0 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

EUVD-2026-50957

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to...

CVE-2026-59920 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

CVE-2026-14996

IBM Aspera Faspex 5.0.0–5.0.15.4 contains a session-management vulnerability (CVE-2026-14996) with high impact on confidentiality and potential for unauthorized access. The issue affects Faspex 5 deployments prior to 5.0.16 and is addressed by upgrading to IBM Aspera Faspex 5.0.16. This bulletin ...

CVE-2026-63727

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to...

CVE-2026-65443 WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

CVE-2026-66031

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

EUVD-2026-49397

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66031

The vulnerability CVE-2026-66031 affects Ekushey Project Manager CRM version 5.0. It is a stored cross-site scripting (XSS) flaw triggered by malicious payloads entered into the Reply Ticket field, executable in the browser sessions of Staff or Administrator users when they view the Support Ticke...