ROOT-APP-NPM-CVE-2025-7783 CVE-2025-7783 in form-data - Patched by Root

Root has patched CVE-2025-7783 in the form-data package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-58PV-8J8X-9VJ2 GHSA-58pv-8j8x-9vj2 in jaraco.context - Patched by Root

Root has patched GHSA-58pv-8j8x-9vj2 in the jaraco.context package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-12816 CVE-2025-12816 in node-forge - Patched by Root

Root has patched CVE-2025-12816 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-42151 CVE-2026-42151 in github.com/prometheus/prometheus - Patched by Root

Root has patched CVE-2026-42151 in the github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44574 CVE-2026-44574 in next - Patched by Root

Root has patched CVE-2026-44574 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44582 CVE-2026-44582 in next - Patched by Root

Root has patched CVE-2026-44582 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-8H8Q-6873-Q5FJ GHSA-8h8q-6873-q5fj in next - Patched by Root

Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-64647 CVE-2026-64647 in next - Patched by Root

Root has patched CVE-2026-64647 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44573 CVE-2026-44573 in next - Patched by Root

Root has patched CVE-2026-44573 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48779 CVE-2026-48779 in ws - Patched by Root

Root has patched CVE-2026-48779 in the ws package for Root:npm. Multiple fixed versions available...

CVE-2026-101132: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal...

PT-2026-102309

Name of the Vulnerable Software and Affected Versions DeepSeek deepseek-harness versions prior to 0.1.7-rc.2 Description A path traversal flaw exists in the Bundle Patch Handler component. A remote attacker can manipulate the dsh.bundle.patch argument within the loadProfile function located in th...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

CVE-2026-28695 Patch Bypass - Craft CMS Blind RCE Authenticat...

CVE-2026-100629

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

CVE-2026-100610

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

CVE-2026-100629

The Capgo (capgo.app backend) before version 12.127.5 is vulnerable to an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The application correctly verifies that the new role's rank does not exceed the caller's rank but fails to check the rank of the role currently bo...

CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

EUVD-2026-87723

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...