Open Source Vulnerabilities

pillow

GHSA-56pw-mpj4-fxww in pillow - Patched by Root

modsecurity, modsecurity, modsecurity

modsecurity, modsecurity, modsecurity, modsecurity-apache, modsecurity-apache, modsecurity-apache

openssh, openssh, openssh, openssh-gssapi

openssh, openssh, openssh, openssh, openssh, openssh, openssh, openssh, openssh

mod_security

CVE-2026-61813 affecting package mod_security 2.9.7-8

symfony, symfony, symfony

mpv, mpv, mpv

c-blosc2, c-blosc2

libsdl3-mixer

blosc

CVE-2026-122330 affecting package blosc 1.21.6-1

libsdl3-mixer

musl, musl, musl, musl, musl

musl, musl, musl

modsecurity, modsecurity, modsecurity, modsecurity-apache, modsecurity-apache, modsecurity-apache

modsecurity, modsecurity, modsecurity

mariadb, mariadb, mariadb

org.springframework:spring-context, org.springframework:spring-web

TuxCare security update for org.springframework (2 CVEs)

OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture

OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

ESPectre: Unsafe Deserialization on .npz dataset leads to Code Execution

ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets

org.springframework:spring-beans, org.springframework:spring-core, org.springframework:spring-web

TuxCare security update for org.springframework (2 CVEs)

ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)

HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service

HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay

Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

org.springframework.security:spring-security-config, org.springframework.security:spring-security-core

TuxCare security update for org.springframework.security (1 CVE)

org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (2 CVEs)

Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass

Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)

ModSecurity: Response Body Inspection Bypass

ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

org.springframework:spring-beans, org.springframework:spring-core, org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webmvc

TuxCare security update for org.springframework (4 CVEs)

ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match

org.springframework.ws:spring-ws-core, org.springframework.ws:spring-ws-security, org.springframework.ws:spring-xml

TuxCare security update for org.springframework.ws (5 CVEs)

org.springframework:spring-context, org.springframework:spring-web

TuxCare security update for org.springframework (2 CVEs)

org.springframework.kafka:spring-kafka

TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)

org.eclipse.jgit:org.eclipse.jgit

TuxCare security update for org.eclipse.jgit:org.eclipse.jgit (2 CVEs)

zipkin-slim, zipkin-slim

zipkin-slim, zipkin-slim

zipkin-slim, zipkin-slim

zipkin-slim, zipkin-slim

zipkin-slim, zipkin-slim

org.springframework:spring, org.springframework:spring-core, org.springframework:spring-web, org.springframework:spring-webmvc

TuxCare security update for org.springframework (4 CVEs)

HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS

MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION