Open Source Vulnerabilities

rubygem-elasticsearch

CVE-2026-115710 affecting package rubygem-elasticsearch 8.9.0-1

rubygem-elasticsearch

CVE-2026-115298 affecting package rubygem-elasticsearch 8.9.0-1

com.rabbitmq:amqp-client

TuxCare security update for com.rabbitmq:amqp-client (1 CVE)

log4j:log4j

TuxCare security update for log4j:log4j (1 CVE)

yaws, yaws

yaws vulnerabilities

Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting

buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler

GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing

com.rabbitmq:amqp-client

TuxCare security update for com.rabbitmq:amqp-client (1 CVE)

ruby-rack

ruby-rack vulnerabilities

io.netty:netty

TuxCare security update for io.netty:netty (1 CVE)

com.rabbitmq:amqp-client

TuxCare security update for com.rabbitmq:amqp-client (1 CVE)

org.jboss.netty:netty

TuxCare security update for org.jboss.netty:netty (1 CVE)

kgateway-2.5

kgateway-2.5

kgateway-2.5

kgateway-2.5

kgateway-2.5

kgateway-2.5

kgateway-2.5

kgateway-2.5

kgateway-2.5

kgateway-2.5

Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints

heartbeat-9.5

heartbeat-9.5

heartbeat-9.5

heartbeat-9.5

heartbeat-9.5

github.com/tinfoil-factory/netfoil

Netfoil doesn't decrement TTL

org.springframework.kafka:spring-kafka

TuxCare security update for org.springframework.kafka:spring-kafka (2 CVEs)

Metalama.Framework, Metalama.Framework, Metalama.Framework

Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution

com.google.guava:guava

TuxCare security update for com.google.guava:guava (2 CVEs)

metricbeat-9.5

metricbeat-9.5

metricbeat-9.5

metricbeat-9.5

metricbeat-9.5

Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator

com.google.guava:guava

TuxCare security update for com.google.guava:guava (2 CVEs)

github.com/basekick-labs/arc

Arc has unauthenticated application log disclosure via `/api/v1/logs`

kernel-64kb, kernel-default, kernel-default-base, kernel-source, kernel-zfcpdump, kernel-docs, kernel-obs-build, kernel-source, kernel-syms, kernel-default, kernel-default, kernel-livepatch-SLE15-SP7_Update_24, kernel-azure, kernel-default, kernel-default

Security update for the Linux Kernel

wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.c

Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handler

Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN

TeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Import

Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints

org.jsoup:jsoup

TuxCare security update for org.jsoup:jsoup (2 CVEs)

org.wildfly.security:wildfly-elytron

TuxCare security update for org.wildfly.security:wildfly-elytron (3 CVEs)