CLSA-2026-1788279532 TuxCare security update for org.springframework.data (1 CVE)

TuxCare rebuilt 5 org.springframework.data packages to address 1 CVE. Fixed in 4.2.12-tuxcare.3...

CLSA-2026-1788200439 TuxCare security update for org.springframework.data (4 CVEs)

TuxCare rebuilt 3 org.springframework.data packages to address 4 CVEs. Fixed in 4.3.13-tuxcare.4...

CLSA-2026-1787931162 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 5.2.2-tuxcare.1...

CLSA-2026-1787920143 TuxCare security update for jquery (8 CVEs)

TuxCare rebuilt jquery to address 8 CVEs. Fixed in 1.4.2-tuxcare.1...

CLSA-2026-1787224839 TuxCare security update for bootstrap (7 CVEs)

TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.2-tuxcare.1...

CLSA-2026-1786966627 TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 11.2.1.post5+tuxcare...

CLSA-2026-1786693842 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4...

CLSA-2026-1786609560 TuxCare security update for org.grails (18 CVEs)

TuxCare rebuilt 33 org.grails packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1...

CLSA-2026-1785917668 TuxCare security update for 36 packages (3 CVEs)

TuxCare rebuilt 36 packages to address 3 CVEs. Fixed in 7.0.109-tuxcare.4...

CLSA-2026-1785914728 TuxCare security update for certifi (2 CVEs)

TuxCare rebuilt certifi to address 2 CVEs. Fixed in 2022.12.7.post3+tuxcare...

CLSA-2026-1785727932 TuxCare security update for org.apache.logging.log4j (3 CVEs)

TuxCare rebuilt 33 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.17.2-tuxcare.2...

CLSA-2026-1784943412 TuxCare security update for axios (4 CVEs)

TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.27.2-tuxcare.3...

CLSA-2026-1784769536 TuxCare security update for 2 packages (2 CVEs)

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 3.2.0-tuxcare.4...

CLSA-2026-1784769544 TuxCare security update for protobufjs (8 CVEs)

TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1784077469 TuxCare security update for com.mchange:mchange-commons-java (1 CVE)

TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.15-tuxcare.1...

CLSA-2026-1782954040 TuxCare security update for @angular (20 CVEs)

TuxCare rebuilt 6 @angular packages to address 20 CVEs. Fixed in 7.2.0-tuxcare.1...

CLSA-2026-1782262731 TuxCare security update for ckeditor (1 CVE)

TuxCare rebuilt ckeditor to address 1 CVE. Fixed in 4.5.11-tuxcare.1...

CLSA-2026-1776127931 TuxCare security update for craftcms/cms (2 CVEs)

TuxCare rebuilt craftcms/cms to address 2 CVEs. Fixed in 3.9.15-p2+tuxcare...

CLSA-2026-1774313530 TuxCare security update for craftcms/cms (10 CVEs)

TuxCare rebuilt craftcms/cms to address 10 CVEs. Fixed in 3.9.15-p1+tuxcare...

CLSA-2026-1773017339 TuxCare security update for laravel/framework (10 CVEs)

TuxCare rebuilt laravel/framework to address 10 CVEs. Fixed in 5.4.36-p2+tuxcare...

CLSA-2026-1780361416 TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 17.1.1-tuxcare.1...

CLSA-2026-1778114659 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 10 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...

CLSA-2026-1776818212 TuxCare security update for io.netty (4 CVEs)

TuxCare rebuilt 47 io.netty packages to address 4 CVEs. Fixed in 4.1.115.Final-tuxcare.4...

CLSA-2026-1776731783 TuxCare security update for league/commonmark (1 CVE)

TuxCare rebuilt league/commonmark to address 1 CVE. Fixed in 1.6.7-p3+tuxcare...

CLSA-2026-1776386158 TuxCare security update for io.netty (12 CVEs)

TuxCare rebuilt 47 io.netty packages to address 12 CVEs. Fixed in 4.1.93.Final-tuxcare.1...

CLSA-2026-1775867597 TuxCare security update for nuxt (1 CVE)

TuxCare rebuilt nuxt to address 1 CVE. Fixed in 4.0.3-tuxcare.1...

CLSA-2026-1774916716 TuxCare security update for node-forge (2 CVEs)

TuxCare rebuilt node-forge to address 2 CVEs. Fixed in 0.10.0-tuxcare.1...

CLSA-2026-1774570939 TuxCare security update for express-jwt (1 CVE)

TuxCare rebuilt express-jwt to address 1 CVE. Fixed in 0.1.4-tuxcare.1...

CLSA-2026-1774311649 TuxCare security update for ua-parser-js (3 CVEs)

TuxCare rebuilt ua-parser-js to address 3 CVEs. Fixed in 0.7.21-tuxcare.1...

CLSA-2026-1773188124 TuxCare security update for jquery (4 CVEs)

TuxCare rebuilt jquery to address 4 CVEs. Fixed in 2.2.4-tuxcare.1...

CLSA-2026-1773188120 TuxCare security update for 38 packages (23 CVEs)

TuxCare rebuilt 38 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1...

CLSA-2025-1765930349 TuxCare security update for sentence-transformers (1 CVE)

TuxCare rebuilt sentence-transformers to address 1 CVE. Fixed in 2.7.0.post1+tuxcare...

CLSA-2025-1765930336 TuxCare security update for pyjwt (1 CVE)

TuxCare rebuilt pyjwt to address 1 CVE. Fixed in 1.7.1.post1+tuxcare...

CLSA-2026-1770682156 TuxCare security update for org.hibernate (1 CVE)

TuxCare rebuilt 8 org.hibernate packages to address 1 CVE. Fixed in 5.4.3.Final-tuxcare.1...

CLSA-2025-1762474006 TuxCare security update for com.nimbusds:nimbus-jose-jwt (1 CVE)

TuxCare rebuilt com.nimbusds:nimbus-jose-jwt to address 1 CVE. Fixed in 9.22-tuxcare.2...

CLSA-2025-1753056170 TuxCare security update for 35 packages (1 CVE)

TuxCare rebuilt 35 packages to address 1 CVE. Fixed in 8.5.100.tuxcare.2...

CLSA-2026-1780062116 Fix CVE(s): CVE-2026-41035

SECURITY UPDATE: use-after-free in receivexattr - debian/patches/CVE-2026-41035.patch: replace stale local 'count' with tempxattr.count in the qsort call inside receivexattr, so the sort uses the live size of the rebuilt xattr items list; victim must run rsync with -X / --xattrs - CVE-2026-41035...

CLSA-2026-1780054763 Fix CVE(s): CVE-2026-41035

SECURITY UPDATE: use-after-free in receivexattr - debian/patches/CVE-2026-41035.patch: replace stale local 'count' with tempxattr.count in the qsort call inside receivexattr, so the sort uses the live size of the rebuilt xattr items list; victim must run rsync with -X / --xattrs - CVE-2026-41035...

CLSA-2026-1780054583 Fix CVE(s): CVE-2026-3039

SECURITY UPDATE: GSS-API resource leak triggered by multi-round TKEY - debian/patches/CVE-2026-3039.patch: reject GSSSCONTINUENEEDED in dstgssapiacceptctx and release the partial security context and gouttoken so they don't accumulate per malicious TKEY query. - CVE-2026-3039...

CLSA-2026-1779697425 postgresql: Fix of CVE-2026-6478

CVE-2026-6478: backport upstream prerequisite that introduces the timingsafebcmp constant-time memory comparison helper, then apply it to SCRAM and MD5 authentication paths that previously used memcmp or strcmp on password hashes, computed keys, and SCRAM nonces, to prevent timing-side-channel...

CLSA-2026-1779694727 Fix CVE(s): CVE-2026-29518

SECURITY UPDATE: daemon-no-chroot TOCTOU symlink race - debian/patches/CVE-2026-29518.patch: track per-module chroot in amchrooted and usesecuresymlinks; route the sender's read-path open, the receiver's basis-file open, mkstemp, and inplace write through securerelativeopen / securemkstemp -...

CLSA-2026-1779369649 rsync: Fix of CVE-2026-43618

CVE-2026-43618: fix integer overflow in compressed-token decoder allowing remote memory disclosure via crafted compressed stream...

CLSA-2026-1779360036 dovecot: Fix of CVE-2026-42006

CVE-2026-42006: fix imap-login listcountlimit to actually limit open '' characters; the previous fix limited closing '' instead, leaving the bracing memory exhaustion vector open...

CLSA-2026-1779355613 Fix CVE(s): CVE-2026-3833

SECURITY UPDATE: nameConstraints case-sensitive comparison bypass - debian/patches/CVE-2026-3833.patch: perform case-insensitive comparison of dNSName and rfc822Name domain labels in X.509 nameConstraints processing, fixing excludedSubtrees / permittedSubtrees bypass via letter-casing in the SAN....

CLSA-2026-1779217317 systemd: Fix of CVE-2026-29111

CVE-2026-29111: core: validate input cgroup path more prudently...

CLSA-2026-1779204107 php: Fix of 6 CVEs

CVE-2026-6722: fix stale SOAPGLOBAL refmap pointer with Apache Map GHSA-85c2-q967-79q5 - CVE-2026-7262: fix broken Apache map value NULL check in soap encoder GHSA-hmxp-6pc4-f3vv - CVE-2026-7568: fix signed integer overflow of char array offset in metaphone GHSA-96wq-48vp-hh57 - CVE-2026-7261:...

CLSA-2026-1779183792 gnutls: Fix of CVE-2026-42010

CVE-2026-42010: server-side RSA-PSK authentication bypass via NUL-byte truncation of binary PSK identities in gnutlsprocrsapskclientkx...

CLSA-2026-1779181743 pyOpenSSL: Fix of CVE-2026-27448

CVE-2026-27448: fix fail-open in settlsextservernamecallback when callback raises exception...

CLSA-2026-1779180310 kernel: Fix of CVE-2026-46333

ptrace: require CAPSYSPTRACE when task has no mm CVE-2026-46333...

CLSA-2026-1779129626 httpd: Fix of CVE-2026-28780

CVE-2026-28780: modproxyajp: heap-based buffer overflow in ajpmsgcheckheader — message size check did not subtract AJPHEADERLEN, letting a crafted AJP reply write 4 bytes past the end of the heap buffer...