Open Source Vulnerabilities

python-min

tar filter allows writing outside destination via empty-named symlink

@ai-sdk/openai

TuxCare security update for @ai-sdk/openai (1 CVE)

python-tensorboard

CVE-2026-119025 affecting package python-tensorboard 2.16.2-6

node-open, node-open, node-open

mlflow

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

terraform-1.10

libpython

tar filter allows writing outside destination via empty-named symlink

gcc-toolset-15-gcc

Moderate: gcc-toolset-15-gcc security update

bind

Moderate: bind security update

brotli

Important: brotli security update

xdg-dbus-proxy

Important: xdg-dbus-proxy security update

emacs

Important: emacs security update

thunderbird

Important: thunderbird security, bug fix, and enhancement update

libXrender

Important: libXrender security update

libXi

Moderate: libXi security update

yggdrasil

Important: yggdrasil security update

kernel

Important: kernel security, bug fix, and enhancement update

libXtst

Important: libXtst security update

python-urllib3

Important: python-urllib3 security update

org.springframework.boot:spring-boot-actuator, org.springframework.boot:spring-boot-devtools

TuxCare security update for org.springframework.boot (2 CVEs)

java-25-openjdk

Important: java-25-openjdk security update

podman

Important: podman security update

kernel

Important: kernel security, bug fix, and enhancement update

buildah

Important: buildah security update

skopeo

Important: skopeo security update

brotli

Important: brotli security update

xdg-dbus-proxy

Important: xdg-dbus-proxy security update

laravel/framework

TuxCare security update for laravel/framework (1 CVE)

java-17-openjdk

Important: java-17-openjdk security update for Rocky Linux 8

libreswan

Important: libreswan security update

apache-commons-collections, apache-commons-collections, apache-commons-collections, apache-commons-lang, apache-commons-lang, apache-commons-net, apache-commons-net, apache-commons-net, bea-stax, bea-stax, glassfish-fastinfoset, glassfish-fastinfoset, glassfish-jaxb, glassfish-jaxb, glassfish-jaxb-api, glassfish-jaxb-api, jackson-annotations, jackson-core, jackson-core, jackson-databind, jackson-databind, jackson-jaxrs-providers, jackson-modules-base, jakarta-commons-httpclient, jakarta-commons-httpclient, jakarta-commons-httpclient, javassist, javassist, javassist, pki-servlet-engine, pki-servlet-engine, relaxngDatatype, relaxngDatatype, slf4j, slf4j, slf4j, slf4j, slf4j, stax-ex, stax-ex, velocity, velocity, velocity, xalan-j2, xalan-j2, xalan-j2, xerces-j2, xerces-j2, xerces-j2, xml-commons-apis, xml-commons-apis, xml-commons-apis, xml-commons-apis, xml-commons-resolver, xml-commons-resolver, xml-commons-resolver, xmlstreambuffer, xmlstreambuffer, xsom, xsom

Important: pki-deps:10.6 security update

thunderbird

Important: thunderbird security update

gcc-toolset-15-gcc

Moderate: gcc-toolset-15-gcc security update

libXrender

Important: libXrender security update

libXi

Moderate: libXi security update

libXtst

Important: libXtst security update

webkit2gtk3

Important: webkit2gtk3 security update

brotli

Important: brotli security update

python-urllib3

Important: python-urllib3 security update

emacs

Important: emacs security update

juniper_warp

Unbounded memory use on large request bodies

wasmtime-wasi

wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving

wasmtime-wasi-http

wasi-http p2: outgoing content-length can be invalid or not match body

wasmtime

Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check

wasmtime

Cross-engine type confusion with host-created struct-types-with-supertypes

wasmtime

Unchecked memory usage in transferring borrowed resources between components

sn-releases

`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)

umoci

@opentelemetry/propagator-jaeger

TuxCare security update for @opentelemetry/propagator-jaeger (1 CVE)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)