PT-2026-132683

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.10.0-tuxcare.1...

PT-2026-132602

TuxCare rebuilt @react-router/remix-routes-option-adapter to address 3 CVEs. Fixed in 7.5.1-tuxcare.10...

PT-2026-117472

Name of the Vulnerable Software and Affected Versions Picomatch versions prior to 4.0.8 Description A regular expression denial of service ReDoS occurs when parsing single-branch repeated extglob patterns, such as + or +a. The analyzeRepeatedExtglob function in lib/parse.js fails to handle these...

PT-2026-118082

containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd...

PT-2026-117363

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

PT-2026-131224

TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 19.2.21-tuxcare.9...

PT-2026-132657

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-131957

TuxCare rebuilt @angular/service-worker to address 1 CVE. Fixed in 10.2.5-tuxcare.7...

PT-2026-132605

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.31-tuxcare.1...

PT-2026-132612

TuxCare rebuilt @babel/runtime-corejs2 to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-131231

TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 10.2.5-tuxcare.13...

PT-2026-117634

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 14.3.3 markdown-it versions prior to 15.0.3 Description When the html option or commonmark preset is enabled, the parser can be forced into quadratic processing time when encountering repeated unterminated inline...

PT-2026-117540

Name of the Vulnerable Software and Affected Versions markdown-it versions prior to 14.3.2 markdown-it versions prior to 15.0.2 Description When the typographer option is set to true, specially crafted Markdown input can trigger quadratic processing time within the smartquotes rule. This occurs...

PT-2026-131671

TuxCare rebuilt @angular/platform-browser-dynamic to address 5 CVEs. Fixed in 18.2.14-tuxcare.12...

PT-2026-132507

debian/rules: disable the build-time test suite on armel, which is built under emulation and too slow to run it...

PT-2026-132623

TuxCare rebuilt @babel/runtime-corejs2 to address 1 CVE. Fixed in 7.26.9-tuxcare.1...

PT-2026-132616

TuxCare rebuilt @babel/runtime-corejs2 to address 1 CVE. Fixed in 7.11.2-tuxcare.3...

PT-2026-132660

TuxCare rebuilt @babel/plugin-transform-sticky-regex to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-132670

TuxCare rebuilt @react-router/serve to address 1 CVE. Fixed in 7.5.1-tuxcare.7...

PT-2026-118085

containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd...

PT-2026-122238

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.19 Wasmtime versions prior to 48.0.7 Wasmtime versions prior to 49.0.4 Description The Cranelift compiler backend on aarch64 can incorrectly compile a Wasm br table instruction when it contains more than...

PT-2026-117517

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loan history maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data...

PT-2026-117334

A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation. The attack may be launched remotely. This attack is...

PT-2026-117304

A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation erro...

PT-2026-132408

Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent...

PT-2026-132709

TuxCare rebuilt create-react-router to address 1 CVE. Fixed in 7.5.1-tuxcare.7...

PT-2026-132544

TuxCare rebuilt @react-router/architect to address 1 CVE. Fixed in 7.5.1-tuxcare.7...

PT-2026-132672

TuxCare rebuilt @react-router/serve to address 3 CVEs. Fixed in 7.5.1-tuxcare.10...

PT-2026-132697

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.4.1-tuxcare.1...

PT-2026-132587

TuxCare rebuilt @babel/runtime-corejs3 to address 1 CVE. Fixed in 7.11.5-tuxcare.3...

PT-2026-132552

TuxCare rebuilt @react-router/cloudflare to address 1 CVE. Fixed in 7.5.1-tuxcare.8...

PT-2026-132407

Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr load image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md...

PT-2026-132707

TuxCare rebuilt create-react-router to address 3 CVEs. Fixed in 7.5.1-tuxcare.5...

PT-2026-132591

TuxCare rebuilt @babel/runtime-corejs3 to address 1 CVE. Fixed in 7.26.9-tuxcare.1...

PT-2026-132686

TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.12.6-tuxcare.1...

PT-2026-132702

TuxCare rebuilt axios to address 11 CVEs. Fixed in 1.18.0-tuxcare.2...

PT-2026-132409

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like + or +a, which analyzeRepeatedExtglob in lib/parse.js skips, causing exponenti...

PT-2026-130896

TuxCare rebuilt @angular/platform-browser to address 1 CVE. Fixed in 15.2.6-tuxcare.7...

PT-2026-116671

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open cached dir sends CREATE and QUERY INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

PT-2026-116672

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2 open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2 parse contexts rejects malformed context data, SMB2 open...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

PT-2026-116683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the RISC-V KVM implementation during vCPU teardown. The non-Sstc hrtimer callback clears the next set variable before its final uses of the enclosing vCPU. If...

PT-2026-116692

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

PT-2026-116717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev entry reference leak in mlx5 tc ct shared counter get When the reverse entry is found but its counter is already being released, refcount inc not zero fails and the reference taken by mlx5 tc ct entry get is nev...

PT-2026-116755

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanup offline cgwbs workfn drains a dying cgwb by calling cleanup offline cgwb until it returns false, with a cond resched between passes. On a CONFIG PREEMPTION...

PT-2026-116764

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata scsi set passthru sense fields trusts it...

PT-2026-116787

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan na create samples LL RESERVED SPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan changelink can update needed headroom betwee...

PT-2026-116810

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb pointer if linear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. Th...

PT-2026-116817

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6 insert exception for dying fib6 info. Before the cited commit, fib6 nh flush exceptions always set from-exception bucket flushed = 1 under rt6 exception lock to prevent rt6 insert exception from inserting a new...

PT-2026-116863

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htab map lookup and delete batch htab map lookup and delete batch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPF MAP LOOKU...