ROOT-APP-NPM-GHSA-5RRQ-PXF6-6JX5 GHSA-5rrq-pxf6-6jx5 in node-forge - Patched by Root

Root has patched GHSA-5rrq-pxf6-6jx5 in the node-forge package for Root:npm. Multiple fixed versions available...

at.researchstudio.sat:won-facets (>=0.2, <=0.3), at.researchstudio.sat:won-facets-tx (>=0.2, <=0.3) +664 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (4.3.8.release)

org.springframework:spring-webmvc MAVEN version 4.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.researchstudio.sat:won-facets =0.2, =0.2, =0.2.7, =0.0.1-release, =0.0.3, =0.0.1,...

PT-2026-82557

Name of the Vulnerable Software and Affected Versions Netron versions prior to 9.1.3 Description The desktop application contains a Reflected Cross-Site Scripting XSS flaw caused by unsanitized node names. This allows an attacker to hide specific nodes, conduct port scanning, or leverage a Chrome...

CVE-2026-53578: Improper Neutralization of Input During Web Page Generation

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied impo...

CVE-2026-53579: Improper Neutralization of Input During Web Page Generation

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

PT-2026-86560

Root has patched GHSA-gf8q-jrpm-jvxq in the node-forge package for Root:npm. Multiple fixed versions available...

PT-2026-86559

Root has patched GHSA-5rrq-pxf6-6jx5 in the node-forge package for Root:npm. Multiple fixed versions available...

CVE-2026-79720: Improper Neutralization of Input During Web Page Generation

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

PT-2026-82681

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied impo...

PT-2026-82555

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

TencentOS Server 3: nodejs:22 (TSSA-2026:0922)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0922 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-79719: Improper Neutralization of Input During Web Page Generation

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

PT-2026-82556

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

TencentOS Server 3: nodejs:24 (TSSA-2026:0919)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0919 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-61617

Wings , the server control plane for the Pterodactyl game-server management panel, contains a disk-quota enforcement flaw in its SFTP write path (versions up to and including 1.13.2 ). Wings checks available disk space only once as a boolean when the write handle is opened—using a stale cached va...

CVE-2026-61617

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

AZL-97740 CVE-2026-74739 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: skip hash tables in u32bindclass u32walk enumerates both struct tcuhnode and struct tcuknode through the walker callback. u32bindclass unconditionally casts the passed fh to tcuknode and accesses &n-res, so whe...