ROOT-APP-PYPI-CVE-2026-34517 CVE-2026-34517 in aiohttp - Patched by Root

Root has patched CVE-2026-34517 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-22815 CVE-2026-22815 in aiohttp - Patched by Root

Root has patched CVE-2026-22815 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

CVE-2026-72577

creationtimestamp| type| source ---|---|--- 2026-08-10 11:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspzcgmhzz2u...

CVE-2026-72575

creationtimestamp| type| source ---|---|--- 2026-08-10 11:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspzcf56622b...

ROOT-APP-PYPI-CVE-2026-47734 CVE-2026-47734 in dulwich - Patched by Root

Root has patched CVE-2026-47734 in the dulwich package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-42305 CVE-2026-42305 in dulwich - Patched by Root

Root has patched CVE-2026-42305 in the dulwich package for Root:PyPI. Multiple fixed versions available...

CVE-2026-72564

creationtimestamp| type| source ---|---|--- 2026-08-10 11:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspz37yutk2n...

ROOT-OS-ALPINE-322-CVE-2025-70873 CVE-2025-70873 in sqlite - Patched by Root

Root has patched CVE-2025-70873 in the sqlite package for Root:Alpine:3.22. Multiple fixed versions available...

MINI-WQR5-3QFJ-VP55

Bulletin has no description...

CVE-2026-72591

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72587

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...

CVE-2026-72581

A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...

CVE-2026-72564

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

CVE-2026-64941

The CVE describes an Open Redirect in Phoenix.LiveView.validate_local_url!/2 where ASCII tab, LF or CR are not rejected. This allows a crafted :to value to bypass path-only validation and be resolved as a scheme-relative URL (e.g., //example.com) when using redirect/2 and related navigation funct...

CGA-9R48-97QH-W35P

Bulletin has no description...

CVE-2026-59087

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker ...

CVE-2026-66486

creationtimestamp| type| source ---|---|--- 2026-08-10 10:45:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/edsgdcj66b3ei 2026-08-10 12:15:14+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-66484...

PYSEC-2026-3629 Keras: HDF5 virtual datasets can disclose local files

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore.verifydataset and fileeditor.py methods, which fail to check the dataset.isvirtual property of HDF5 datasets. This allows ...

Keras: HDF5 virtual datasets can disclose local files

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore.verifydataset and fileeditor.py methods, which fail to check the dataset.isvirtual property of HDF5 datasets. This allows ...

CVE-2026-72593

The CVE-2026-72593 entry concerns dulldusk/phpfm up to version 1.8.0, where a missing authentication flaw permits an unauthenticated remote attacker to access the full file management capabilities (read, write, delete, upload) on the server filesystem. The root cause is an authentication check in...