tomcat: Apache Tomcat: Error condition not handled when configuring CRLs

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...

tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might...

tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources...

tomcat: security constraint bypass with HTTP/0.9

A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0...

Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended...

Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension

A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...

poc-ghas-vulnerability-report-generator

GHAS Vulnerability Report Generator !WARNING This proof...

ROOT-OS-DEBIAN-13-CVE-2026-56373 CVE-2026-56373 in imagemagick - Patched by Root

Root has patched CVE-2026-56373 in the imagemagick package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-56366 CVE-2026-56366 in imagemagick - Patched by Root

Root has patched CVE-2026-56366 in the imagemagick package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-61465 CVE-2026-61465 in imagemagick - Patched by Root

Root has patched CVE-2026-61465 in the imagemagick package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-61863 CVE-2026-61863 in imagemagick - Patched by Root

Root has patched CVE-2026-61863 in the imagemagick package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-87743

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

ROOT-APP-NPM-AIKIDO-2026-10759 AIKIDO-2026-10759 in next - Patched by Root

Root has patched AIKIDO-2026-10759 in the next package for Root:npm. Multiple fixed versions available...

codex-security npm-v0.1.28

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. Features Scan repositories, selected paths, or Git changes. Deep scans run parallel discovery workers on repositories and selected paths. Validate candidate...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (ROCm 6.4)

Red Hat AI Base Images 3.3.3 ROCm 6.4 is now available. Red Hat® AI Base Images...

CVE-2026-92860

CVE-2026-92860 affects rcourtman Pulse versions up to 6.0.4/6.1.0-rc.4 . The vulnerability resides in the Quick Security Setup Handler component, specifically the fmt.Sprintf function within /api/security/quick-setup. Manipulating the Username argument triggers improper input validation , enablin...

CLSA-2026-1789638824 TuxCare security update for drupal/tfa_basic (1 CVE)

TuxCare rebuilt drupal/tfabasic to address 1 CVE. Fixed in 7.1.2-p1+tuxcare...

ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in langchain - Patched by Root

Root has patched GHSA-gr75-jv2w-4656 in the langchain package for Root:PyPI. Multiple fixed versions available...

firefox: Sandbox escape due to use-after-free in the DOM: Security component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Security component...

firefox: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant...