PT-2026-123067

TuxCare rebuilt 16 org.apache.avro packages to address 1 CVE. Fixed in 1.7.7-tuxcare.5...

PT-2026-123077

TuxCare rebuilt tar to address 12 CVEs. Fixed in 6.0.2-tuxcare.6...

PT-2026-123065

TuxCare rebuilt 14 org.asynchttpclient packages to address 3 CVEs. Fixed in 2.12.1-tuxcare.2...

PT-2026-123087

TuxCare rebuilt 6 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.17-tuxcare.9...

PT-2026-115186

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to...

PT-2026-115181

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated...

PT-2026-115191

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...

PT-2026-115196

Name of the Vulnerable Software and Affected Versions Netgate pfSense CE versions prior to 2.9.0 Description An authorization bypass exists that allows read-only WebGUI users to replace the config.xml file. This occurs because the config restore and config install functions ignore the User -...

PT-2026-114432

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse webpage, search web, and torrent metadata parsers, which then get passed to the...

PT-2026-122765

Security vulnerability affects the nfs-subdir-external-provisioner package. Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method...

PT-2026-122755

Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...

PT-2026-122749

Security vulnerability affects the grafana-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-122730

Security vulnerability affects the nfs-subdir-external-provisioner package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input...

PT-2026-115127

Name of the Vulnerable Software and Affected Versions AdPlug versions prior to 2.5 Description A heap out-of-bounds read occurs in the CdmoLoader::load function within src/dmo.cpp. This issue allows an attacker to read data beyond a heap allocation by providing a truncated TwinTeam DMO file...

PT-2026-122718

Security vulnerability affects the wso2mi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...

PT-2026-122814

Security vulnerability affects the strimzi-kafka-operator package. In Eclipse Vert...

PT-2026-122861

Security vulnerability affects the strimzi-kafka-operator package. Netty io...

PT-2026-122760

Security vulnerability affects the renovate package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

PT-2026-122688

Security vulnerability affects the nfs-subdir-external-provisioner package. Within HostnameError...

PT-2026-123081

TuxCare rebuilt qs to address 1 CVE. Fixed in 3.1.0-tuxcare.4...

PT-2026-122708

Security vulnerability affects the grafana-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-115016

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

PT-2026-115197

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator color value that display...

PT-2026-122736

Security vulnerability affects the langfuse package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon...

PT-2026-122752

Security vulnerability affects the temporal-server-fips package. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only...

PT-2026-122697

Security vulnerability affects the kafka package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

PT-2026-122849

Security vulnerability affects the strimzi-kafka-operator package. A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com...

PT-2026-123079

TuxCare rebuilt qs to address 1 CVE. Fixed in 2.3.3-tuxcare.2...

PT-2026-122835

Security vulnerability affects the kafka package. yawkat LZ4 Java provides LZ4 compression for Java...

PT-2026-123085

TuxCare rebuilt 7 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.0.10-tuxcare.3...

PT-2026-122768

Security vulnerability affects the kafka package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

PT-2026-122756

Security vulnerability affects the mongodb package. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS...

PT-2026-122865

Security vulnerability affects the grafana-fips package. OpenFGA is an authorization/permission engine built for developers...

PT-2026-122686

Security vulnerability affects the langfuse package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon...

PT-2026-123133

TuxCare rebuilt 21 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.14-tuxcare.8...

PT-2026-123138

TuxCare rebuilt 21 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1...

PT-2026-122832

Security vulnerability affects the prometheus package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

PT-2026-122869

Security vulnerability affects the argo-cd package. go-git is an extensible git implementation library written in pure Go...

PT-2026-122840

Security vulnerability affects the langfuse package. Nodemailer before 10...

PT-2026-123142

TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.8...

PT-2026-123083

TuxCare rebuilt 6 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.16-tuxcare.2...

PT-2026-123137

TuxCare rebuilt 4 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.2.12.RELEASE-tuxcare.1...

PT-2026-114952

Name of the Vulnerable Software and Affected Versions symfony/yaml versions 5.4.0 through 5.4.53 symfony/yaml versions 6.0.0-BETA1 through 6.4.44 symfony/yaml versions 7.0.0-BETA1 through 7.4.17 symfony/yaml versions 8.0.0-BETA1 through 8.1.5 Description The YamlParser::lexInlineStructure functio...

PT-2026-122769

Security vulnerability affects the external-dns package. On Unix platforms, when listing the contents of a directory using File...

PT-2026-122871

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

PT-2026-122841

GHSA-mhm7-754m-9p8w affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-123109

TuxCare rebuilt 3 io.projectreactor packages to address 2 CVEs. Fixed in 3.7.19-tuxcare.1...

PT-2026-123140

TuxCare rebuilt 21 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.12-tuxcare.11...

PT-2026-122853

Security vulnerability affects the py3-pydantic-ai package. Pydantic AI is a Python agent framework for building applications and workflows with Generative AI...

PT-2026-115018

Name of the Vulnerable Software and Affected Versions Amazon Neptune engine versions prior to 1.5.0.0 Description Deserialization of untrusted data in the Gremlin graph data import component allows an authenticated remote actor with standard database permissions to execute arbitrary code and acce...