CLSA-2026-1774570946 TuxCare security update for ajv (1 CVE)

TuxCare rebuilt ajv to address 1 CVE. Fixed in 8.9.0-tuxcare.1...

CLSA-2026-1774138775 TuxCare security update for clean-css (1 CVE)

TuxCare rebuilt clean-css to address 1 CVE. Fixed in 3.4.28-tuxcare.1...

CLSA-2026-1773879456 TuxCare security update for cryptography (1 CVE)

TuxCare rebuilt cryptography to address 1 CVE. Fixed in 45.0.7.post1+tuxcare...

CLSA-2026-1773447386 TuxCare security update for loader-utils (1 CVE)

TuxCare rebuilt loader-utils to address 1 CVE. Fixed in 0.2.17-tuxcare.1...

CLSA-2025-1764288754 TuxCare security update for starlette (1 CVE)

TuxCare rebuilt starlette to address 1 CVE. Fixed in 0.13.6.post1+tuxcare...

CLSA-2025-1763943127 TuxCare security update for idna (1 CVE)

TuxCare rebuilt idna to address 1 CVE. Fixed in 2.10.post1+tuxcare...

CVE-2026-64561

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages...

CVE-2026-47746

CVE-2026-47746 affects Misskey (open source federated social platform). Affected versions are 12.37.0 and later, up to but not including 2026.5.4. The issue is a TOCTOU vulnerability in timing attacks during JSON-LD signature validation and the JSON-LD compaction process, caused by a non-shared p...

CVE-2026-46713 Misskey: JSON-LD signature validation + compaction may lead to improper activity handling

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4...

CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

CVE-2026-48031

Technical details about CVE-2026-48031 are not publicly provided in the supplied documents. The go-base JWT-secret issue is described at a high level; monitor for updates for concrete affected versions, root cause, and fixes.

K000162731: Linux kernel vulnerability CVE-2026-63793

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol-volumelabel with a mutex and snaphost the label before copytouser. This prevent a use-after-free when FSIOCSETFSLABEL replaces the vol-volumelabel an...

PT-2026-67448

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

PT-2026-67489

Name of the Vulnerable Software and Affected Versions Socket.IO versions prior to 4.2.7 Socket.IO versions prior to 3.4.5 Socket.IO versions prior to 3.3.6 Description A specially crafted Socket.IO packet can force the server to wait for and buffer an excessive number of binary attachments. This...

CVE-2026-53510

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

UBUNTU-CVE-2026-53501

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

CVE-2026-54729 dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...

EUVD-2025-210568

A Cross-Site Request Forgery CSRF vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions,...

CVE-2025-67649

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66273)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...