Open Source Vulnerabilities

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

kernel-default, kernel-default-base, kernel-source, kernel-default, kernel-default-base, kernel-source, kernel-default, kernel-livepatch-SLE15-SP4_Update_61, kernel-default, kernel-64kb, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-64kb, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-64kb, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-zfcpdump, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms

Security update for the Linux Kernel

oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

kernel-default, kernel-default-base, kernel-source, kernel-default, kernel-livepatch-SLE15-SP5_Update_47, kernel-64kb, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-64kb, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-64kb, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-zfcpdump, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms

Security update for the Linux Kernel

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters

MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter

Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

@opentelemetry/propagator-jaeger

TuxCare security update for @opentelemetry/propagator-jaeger (1 CVE)

System.Security.Cryptography.Pkcs, Rootio.System.Security.Cryptography.Pkcs

CVE-2026-84008 in System.Security.Cryptography.Pkcs - Patched by Root

@ai-sdk/provider-utils

TuxCare security update for @ai-sdk/provider-utils (1 CVE)

@opentelemetry/propagator-jaeger

TuxCare security update for @opentelemetry/propagator-jaeger (1 CVE)

qpid-proton, qpid-proton, qpid-proton

qpid-proton

CVE-2026-115942 affecting package qpid-proton 0.40.0-15

qpid-proton, qpid-proton, qpid-proton

qpid-proton

CVE-2026-114230 affecting package qpid-proton 0.40.0-15

qpid-proton, qpid-proton, qpid-proton

qpid-proton, qpid-proton, qpid-proton

qpid-proton

CVE-2026-105042 affecting package qpid-proton 0.40.0-15

qpid-proton

CVE-2026-105031 affecting package qpid-proton 0.40.0-15

qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton

qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton

qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton, qpid-proton

ingress-nginx-controller-fips-1.15

ingress-nginx-controller-fips-1.15

ingress-nginx-controller-1.15, ingress-nginx-controller-1.15

ingress-nginx-controller-1.15, ingress-nginx-controller-1.15

ingress-nginx-controller-fips-1.15

ingress-nginx-controller-fips-1.15

ingress-nginx-controller-1.15, ingress-nginx-controller-1.15

ingress-nginx-controller-1.15, ingress-nginx-controller-1.15

@ai-sdk/provider-utils

TuxCare security update for @ai-sdk/provider-utils (1 CVE)

OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login

ai

TuxCare security update for ai (1 CVE)

kernel-64kb, kernel-default, kernel-default-base, kernel-source, kernel-zfcpdump, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-default, kernel-default, kernel-livepatch-SLE15-SP7_Update_23, kernel-azure, kernel-default, kernel-default

Security update for the Linux Kernel

pillow

TuxCare security update for pillow (2 CVEs)

kernel-default, kernel-livepatch-SLE15-SP6_Update_33, kernel-default, kernel-64kb, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-zfcpdump, kernel-default, kernel-default-base, kernel-docs, kernel-obs-build, kernel-source, kernel-syms

Security update for the Linux Kernel

markdown-it, @rootio/markdown-it

CVE-2026-111758 in markdown-it - Patched by Root

markdown-it, @rootio/markdown-it

CVE-2026-111759 in markdown-it - Patched by Root

Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name

libsoup, libsoup

Security update for libsoup

libsoup

Security update for libsoup

@modelcontextprotocol/client

TuxCare security update for @modelcontextprotocol/client (1 CVE)

protobufjs

TuxCare security update for protobufjs (1 CVE)

@opentelemetry/core

TuxCare security update for @opentelemetry/core (1 CVE)

c-ares

Use-after-free and memory corruption when application callbacks re-enter c-ares during cancel, destroy, server reconfiguration or connection teardown (GHSA-pj7p-v3cw-hq66, GHSA-rf6g-ww74-97qh, GHSA-97vq-4mxv-7vhm, GHSA-v33j-65h4-4ch8, GHSA-wpr3-8q3r-4q8c, GHSA-mw23-pfg6-2x9r). Backport of the v1.34 fix set the advisories name: 7f408deb, f944c471 (must ship with it) and 13a10ddd (additional paths, needed by GHSA-pj7p-v3cw-hq66). 1.34.5 has no ARES_CONN_FLAG_NONEW, so the ARES_CONN_FLAG_DEAD enum hunk is re-anchored, and 13a10ddd's process_read() check sits before 1.34.5's `return read_answers()`.