ROOT-APP-PYPI-CVE-2026-27026 CVE-2026-27026 in pypdf - Patched by Root

Root has patched CVE-2026-27026 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-31826 CVE-2026-31826 in pypdf - Patched by Root

Root has patched CVE-2026-31826 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27025 CVE-2026-27025 in pypdf - Patched by Root

Root has patched CVE-2026-27025 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-33123 CVE-2026-33123 in pypdf - Patched by Root

Root has patched CVE-2026-33123 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-40260 CVE-2026-40260 in pypdf - Patched by Root

Root has patched CVE-2026-40260 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-33699 CVE-2026-33699 in pypdf - Patched by Root

Root has patched CVE-2026-33699 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27024 CVE-2026-27024 in pypdf - Patched by Root

Root has patched CVE-2026-27024 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-24688 CVE-2026-24688 in pypdf - Patched by Root

Root has patched CVE-2026-24688 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27628 CVE-2026-27628 in pypdf - Patched by Root

Root has patched CVE-2026-27628 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41168 CVE-2026-41168 in pypdf - Patched by Root

Root has patched CVE-2026-41168 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-67MH-4WV8-2F99 GHSA-67mh-4wv8-2f99 in esbuild - Patched by Root

Root has patched GHSA-67mh-4wv8-2f99 in the esbuild package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-5115 CVE-2025-5115 in org.eclipse.jetty.http2:jetty-http2-common - Patched by Root

Root has patched CVE-2025-5115 in the org.eclipse.jetty.http2:jetty-http2-common package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-1948 CVE-2025-1948 in org.eclipse.jetty.http2:jetty-http2-common - Patched by Root

Root has patched CVE-2025-1948 in the org.eclipse.jetty.http2:jetty-http2-common package for Root:Maven. Multiple fixed versions available...

CVE-2026-72833

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...

CVE-2026-72832

Grav before 2.0.13 (versions 1.5.2–2.0.12) contains a stored XSS in Security::detectXss() (system/src/Grav/Common/Security.php). The event-handler detector uses a pattern anchored at “]*?, which fails when a > appears inside a quoted attribute value, allowing a payload such as ” onerror=alert(...

CVE-2026-72815 go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

ROOT-APP-MAVEN-CVE-2023-20860 CVE-2023-20860 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2023-20860 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

SUSE CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

PT-2026-72001

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

CVE-2026-73304 Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...