Open Source Vulnerabilities

org.springframework.kafka:spring-kafka

TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)

stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file

stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name

org.springframework.kafka:spring-kafka

TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)

org.springframework.kafka:spring-kafka

TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)

lodash.template

TuxCare security update for lodash.template (1 CVE)

org.springframework:spring-context, org.springframework:spring-web

TuxCare security update for org.springframework (2 CVEs)

org.springframework.kafka:spring-kafka

TuxCare security update for org.springframework.kafka:spring-kafka (1 CVE)

@modelcontextprotocol/sdk

TuxCare security update for @modelcontextprotocol/sdk (3 CVEs)

@modelcontextprotocol/sdk

TuxCare security update for @modelcontextprotocol/sdk (2 CVEs)

anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response

mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name

Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder

Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints

Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents

eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API

SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails

SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query

@modelcontextprotocol/sdk

TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

org.asynchttpclient:async-http-client, org.asynchttpclient:async-http-client-bom, org.asynchttpclient:async-http-client-example, org.asynchttpclient:async-http-client-extras-guava, org.asynchttpclient:async-http-client-extras-jdeferred, org.asynchttpclient:async-http-client-extras-parent, org.asynchttpclient:async-http-client-extras-registry, org.asynchttpclient:async-http-client-extras-retrofit2, org.asynchttpclient:async-http-client-extras-rxjava, org.asynchttpclient:async-http-client-extras-rxjava2, org.asynchttpclient:async-http-client-extras-simple, org.asynchttpclient:async-http-client-extras-typesafe-config, org.asynchttpclient:async-http-client-netty-utils, org.asynchttpclient:async-http-client-project

TuxCare security update for org.asynchttpclient (16 CVEs)

vite

TuxCare security update for vite (2 CVEs)

org.springframework:spring-beans, org.springframework:spring-core, org.springframework:spring-web, org.springframework:spring-webmvc

TuxCare security update for org.springframework (3 CVEs)

org.springframework.security:spring-security-config, org.springframework.security:spring-security-core

TuxCare security update for org.springframework.security (1 CVE)

vite

TuxCare security update for vite (2 CVEs)

org.springframework.kafka:spring-kafka

TuxCare security update for org.springframework.kafka:spring-kafka (3 CVEs)

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

zipkin, zipkin

org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (3 CVEs)

torchaudio-ffmpeg-tarballs-4.4.4

org.springframework:spring-web, org.springframework:spring-webmvc, org.springframework:spring-websocket

TuxCare security update for org.springframework (3 CVEs)

org.apache.httpcomponents:httpclient

TuxCare security update for org.apache.httpcomponents:httpclient (1 CVE)

glibc-2.44-abi-report, glibc-2.44-abi-report

ca-certificates, ca-certificates-java, ca-certificates, ca-certificates-java, ca-certificates, ca-certificates-java, ca-certificates, ca-certificates-java

ca-certificates update

torchaudio-ffmpeg-tarballs-5.0.3