Open Source Vulnerabilities

libical

libical security update

libical

libical security update

libical

libical security update

libarchive

libarchive security update

libarchive

libarchive security update

libarchive

libarchive security update

nginx

nginx security update

nginx

nginx security update

nginx

nginx security update

nginx

nginx security update

brotli

brotli security update

brotli

brotli security update

tomcat

Apache Tomcat: Possible TLS 1.3 connection failures

brotli

brotli security update

brotli

brotli security update

tomcat

Apache Tomcat: HTTP/2 trailer header cross-contamination

unrtf

unrtf security update

unrtf

unrtf security update

unrtf

unrtf security update

unrtf

unrtf security update

tomcat

tomcat security update

tomcat

tomcat security update

tomcat

tomcat security update

tomcat

Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector

tomcat

tomcat security update

tomcat

Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

tomcat

Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

tomcat

Apache Tomcat: AJP response mix-up

tomcat

Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

tomcat

Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

virtualenv

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

virtualenv

virtualenv activation scripts run code from a path that contains a placeholder name

virtualenv

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

virtualenv

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

virtualenv

virtualenv bash activate runs commands from an environment name with a backslash before $

virtualenv

virtualenv: Deletion recovery can change a symlink target's mode

virtualenv

virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

virtualenv

virtualenv: Generated files can follow existing destination links

virtualenv

virtualenv: Seeded files retain permissions from an older cache

virtualenv

virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv

virtualenv: Xonsh activation literals depend on the script decoding codec

virtualenv

virtualenv: Pip seeding with download omits wheel digest verification

virtualenv

virtualenv: Builtin creation follows linked environment directories

virtualenv

virtualenv: Venv configuration readback can reinterpret path boundaries

virtualenv

virtualenv: Downloaded wheel selection and caching precede verification

virtualenv

virtualenv: Temporary app-data can leave dangling seed package links

rclone

Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url

rclone

Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

rclone

Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback