Open Source Vulnerabilities

PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()

PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions

PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles

kubevirt1.9

Security update for kubevirt1.9

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

opensearch-k8s-operator-fips-2

opensearch-k8s-operator-fips-2

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

drupal/fasttoggle

drupal/fasttoggle

drupal/captcha

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

calico-3.29-apiserver, calico-3.29-app-policy, calico-3.29-calicoctl, calico-3.29-cni, calico-3.29-felix, calico-3.29-key-cert-provisioner, calico-3.29-kube-controllers, calico-3.29-node, calico-3.29-pod2daemon, calico-3.29-typha-client, calico-3.29-typhad

calico-3.29-apiserver, calico-3.29-app-policy, calico-3.29-calicoctl, calico-3.29-cni, calico-3.29-felix, calico-3.29-key-cert-provisioner, calico-3.29-kube-controllers, calico-3.29-node, calico-3.29-pod2daemon, calico-3.29-typha-client, calico-3.29-typhad

step-issuer-fips

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

request

TuxCare security update for request (1 CVE)

@octokit/request-error

TuxCare security update for @octokit/request-error (1 CVE)

frankenphp-8.3

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

@octokit/request

TuxCare security update for @octokit/request (1 CVE)

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (31 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

xorg-server

xorg-server, xorg-server, xorg-server, xwayland, xwayland, xwayland

xorg-server, xwayland

xorg-server

xorg-server, xorg-server, xorg-server, xwayland, xwayland, xwayland

xorg-server, xwayland

xorg-server

xorg-server, xorg-server, xorg-server, xwayland, xwayland, xwayland

xorg-server, xwayland

wayland

CVE-2026-93536 affecting package wayland 1.22.0-1

wayland

CVE-2026-93524 affecting package wayland 1.22.0-1

wayland

CVE-2026-93523 affecting package wayland 1.22.0-1

xorg-x11-server

CVE-2026-93524 affecting package xorg-x11-server 1.20.10-6

xorg-x11-server-Xwayland

CVE-2026-93524 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

xorg-x11-server-Xwayland

CVE-2026-93536 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

xorg-x11-server-Xwayland

CVE-2026-93523 affecting package xorg-x11-server-Xwayland for versions less than 24.1.14-1

xorg-x11-server

CVE-2026-93523 affecting package xorg-x11-server 1.20.10-6

xorg-x11-server

CVE-2026-93536 affecting package xorg-x11-server 1.20.10-6

grafana

grafana

drupal/commerce_payumoney

mongo-java-driver, mongo-java-driver, mongo-java-driver