ROOT-APP-PYPI-CVE-2026-40192 CVE-2026-40192 in pillow - Patched by Root

Root has patched CVE-2026-40192 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48735 CVE-2026-48735 in pypdf - Patched by Root

Root has patched CVE-2026-48735 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-59935 CVE-2026-59935 in pypdf - Patched by Root

Root has patched CVE-2026-59935 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-54530 CVE-2026-54530 in pypdf - Patched by Root

Root has patched CVE-2026-54530 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-49461 CVE-2026-49461 in pypdf - Patched by Root

Root has patched CVE-2026-49461 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-59936 CVE-2026-59936 in pypdf - Patched by Root

Root has patched CVE-2026-59936 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-JM82-FX9C-MX94 GHSA-jm82-fx9c-mx94 in pypdf - Patched by Root

Root has patched GHSA-jm82-fx9c-mx94 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27980 CVE-2026-27980 in next - Patched by Root

Root has patched CVE-2026-27980 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44577 CVE-2026-44577 in next - Patched by Root

Root has patched CVE-2026-44577 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27977 CVE-2026-27977 in next - Patched by Root

Root has patched CVE-2026-27977 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27978 CVE-2026-27978 in next - Patched by Root

Root has patched CVE-2026-27978 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44902 CVE-2026-44902 in @opentelemetry/auto-instrumentations-node - Patched by Root

Root has patched CVE-2026-44902 in the @opentelemetry/auto-instrumentations-node package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54515 CVE-2026-54515 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54515 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

BIT-RCLONE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

BIT-DISCOURSE-2026-72723 Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An...

PT-2026-73435

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer signing.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...

PT-2026-73285

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the installation through custom theme upload path traversal in LocalStorageBas...

PT-2026-76892

Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...

PT-2026-76690

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset passkey, allowing a lower-privileged...

PT-2026-76818

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...