PT-2026-117583

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.43 through 4.79 Description An issue exists during canonical encoding in the utf16 cmp function where byte-string keys are misordered. Canonical encoding sorts keys by UTF-16 code units; however, if any key in a has...

PT-2026-117575

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.28 through 4.79 Description A memory leak occurs when decoding JSON with duplicate keys while using the dupkeys as arrayref option in the decode hv function. In this scenario, values for duplicate object keys are...

PT-2026-117578

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description When a parser object is cloned into a new ithread, the software uses scalars from the parent interpreter. The parser object stores its incremental parse buffer and callbacks as raw scalar...

PT-2026-117581

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description When allow tags is enabled, the class name and argument array of a tagged value are decoded and passed to the THAW method within decode tag. If the THAW method dies, the decoded argument...

PT-2026-117641

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affecte...

PT-2026-117576

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists where memory exhaustion can occur due to the buffering of incremental input beyond the max size limit within the incr parse function. The parser appends each data chunk to its...

PT-2026-117572

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.33 through 4.79 Description An issue exists where duplicate non-ASCII bare keys are not properly handled, leading to type confusion within the decode hv function when dupkeys as arrayref is used. When allow barekey ...

PT-2026-117573

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.33 through 4.79 Description The software accepts malformed UTF-8 in bare hash keys when the allow barekey option is enabled within the decode hv function. While quoted keys are validated as UTF-8, bare keys are stor...

PT-2026-117580

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 3.0202 through 4.79 Description Memory leak occurs when encoding values as strings in the encode stringify function. The issue arises when the function writes a value in string form under allow stringify, convert...

PT-2026-117579

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.42 through 4.79 Description Input chunking can alter the decoded value of top-level numbers within the incr parse function. Because allow nonref is enabled by default and inherited by incr parse, top-level numbers,...

PT-2026-131136

TuxCare rebuilt @angular/platform-server to address 2 CVEs. Fixed in 8.0.0-tuxcare.4...

PT-2026-131153

TuxCare rebuilt @angular/platform-server to address 3 CVEs. Fixed in 16.2.11-tuxcare.2...

PT-2026-130777

TuxCare rebuilt @angular/platform-browser to address 1 CVE. Fixed in 10.2.5-tuxcare.9...

PT-2026-131868

TuxCare rebuilt @angular/service-worker to address 1 CVE. Fixed in 7.2.11-tuxcare.6...

PT-2026-131652

TuxCare rebuilt @angular/platform-browser-dynamic to address 2 CVEs. Fixed in 7.2.16-tuxcare.11...

PT-2026-131204

TuxCare rebuilt @angular/platform-server to address 3 CVEs. Fixed in 7.2.11-tuxcare.5...

PT-2026-131051

TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 16.2.12-tuxcare.5...

PT-2026-130977

TuxCare rebuilt @angular/platform-browser to address 1 CVE. Fixed in 9.1.13-tuxcare.11...

PT-2026-131445

TuxCare rebuilt @angular/platform-browser-dynamic to address 2 CVEs. Fixed in 15.0.3-tuxcare.4...

PT-2026-130993

TuxCare rebuilt @angular/platform-browser to address 2 CVEs. Fixed in 11.2.14-tuxcare.9...

PT-2026-131443

TuxCare rebuilt @angular/platform-browser-dynamic to address 2 CVEs. Fixed in 14.2.8-tuxcare.4...

PT-2026-130730

TuxCare rebuilt @angular/platform-browser to address 1 CVE. Fixed in 14.2.8-tuxcare.1...

PT-2026-131824

TuxCare rebuilt @angular/service-worker to address 3 CVEs. Fixed in 15.2.9-tuxcare.5...

PT-2026-117321

Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass...

PT-2026-117660

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description A double free of image memory can occur when the ImagingScaleAffine function encounters a selective allocation failure. This happens during the fast path processing of Transform.EXTENT or pure...

PT-2026-117683

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The TIFF encoder in Pillow can perform an out-of-bounds read when processing images with retained TIFF metadata where the plane size is inconsistent with BitsPerSample. An attacker can provide a...

PT-2026-130925

TuxCare rebuilt @angular/platform-browser to address 1 CVE. Fixed in 14.2.8-tuxcare.3...

PT-2026-131840

TuxCare rebuilt @angular/service-worker to address 4 CVEs. Fixed in 19.2.21-tuxcare.7...

PT-2026-132896

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max size in incr parse. The parser appends each chunk to its buffer. In scalar or list context, it compares max size with how far it has progressed, not with the buffer length. A chunk that...

PT-2026-132898

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys as arrayref in decode hv. With dupkeys as arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and eve...

PT-2026-132893

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode stringify. encode stringify writes a value in its string form under allow stringify, under convert blessed for objects without TO JSON, and under allow...

PT-2026-132894

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode tag. With allow tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a...

PT-2026-131246

TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 15.0.3-tuxcare.8...

PT-2026-131210

TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 16.2.11-tuxcare.6...

PT-2026-131280

TuxCare rebuilt @angular/platform-server to address 2 CVEs. Fixed in 12.2.0-tuxcare.4...

PT-2026-131399

TuxCare rebuilt @angular/platform-browser-dynamic to address 1 CVE. Fixed in 12.2.17-tuxcare.6...

PT-2026-117374

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Security for Kubernetes affected versions not specified Description An issue exists in the Central SAML authentication ACS endpoint where used SAML assertion or response identifiers are not retained to prevent replay...

PT-2026-130778

TuxCare rebuilt @angular/platform-browser to address 1 CVE. Fixed in 11.2.14-tuxcare.8...

PT-2026-117587

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description A severe issue has been disclosed affecting Microsoft Edge, with reports of elevated activities targeting this flaw. Recommendations At the moment, there is no information about a newe...

PT-2026-118051

Vikunja: Unbounded CSV row cardinality permits API process termination in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

PT-2026-132015

TuxCare rebuilt @babel/helper-builder-react-jsx to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-131527

TuxCare rebuilt @angular/platform-browser-dynamic to address 1 CVE. Fixed in 7.2.11-tuxcare.6...

PT-2026-117577

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.20 through 4.79 Description A write out of bounds occurs during canonical encoding in the encode hv function when a tied or shared hash grows. The encoder utilizes a fixed 64-entry stack array or a heap array sized...

PT-2026-133099

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.9.9-tuxcare.1...

PT-2026-117258

A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli real escape string of the file payment/pay.php. The manipulation of the argument f no/farmer results in sql...

PT-2026-133139

Modify the spec file to include a %check section with the tests, fix a failing test in test io.py...

PT-2026-132904

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection...

PT-2026-132908

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP NO EXTENSIONS or otherwise runs without a...

PT-2026-132906

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme...

PT-2026-132899

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...