Open Source Vulnerabilities

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace

@hono/node-server

TuxCare security update for @hono/node-server (1 CVE)

nodemailer

TuxCare security update for nodemailer (2 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

browserslist

TuxCare security update for browserslist (1 CVE)

drupal/oauth2_token_manager

drupal/field_permissions

tmp

TuxCare security update for tmp (2 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

drupal/field_permissions

serialize-javascript

TuxCare security update for serialize-javascript (1 CVE)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

drupal/oidc

grafana-pyroscope-fips-2.3

grafana-pyroscope-fips-2.3

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

drupal/stage_file_proxy

drupal/sign_widget

Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

drupal/oauth_login_oauth2

org.springframework.cloud:spring-cloud-stream

TuxCare security update for org.springframework.cloud:spring-cloud-stream (4 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

drupal/bulk_update_user_roles

drupal/s3fs

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking

PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data

PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data

PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query

PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views

PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent

PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule

PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting

PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats

PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()

PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions

PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles

kubevirt1.9

Security update for kubevirt1.9

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

opensearch-k8s-operator-fips-2

opensearch-k8s-operator-fips-2

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`