ROOT-APP-MAVEN-CVE-2025-49125 CVE-2025-49125 in io.root.org.apache.tomcat:tomcat-catalina - Patched by Root

Root has patched CVE-2025-49125 in the io.root.org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available...

glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

A flaw was found in GLib. A buffer over-read can occur in giochannelreadlinebackend in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes ...

PT-2026-67489

Name of the Vulnerable Software and Affected Versions Socket.IO versions prior to 4.2.7 Socket.IO versions prior to 3.4.5 Socket.IO versions prior to 3.3.6 Description A specially crafted Socket.IO packet can force the server to wait for and buffer an excessive number of binary attachments. This...

SUSE CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

EUVD-2026-51519

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

PT-2026-66775

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.3 through 9.16 Description In SERVER mode, the per-tool permission system fails to consistently enforce permission checks. While a permissions required decorator is used on the initial route of a tool, subsequent backend...

Malicious Package

Overview ethers-io-ethers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in ethers-io-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d93060f754bea6c9c2c5722e253ef9599335702d72a39effe29b2b7668937dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-68502

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get'value' to LazyOwnShell.onecmd, reaching LazyOwnShell.docmd and subprocess.callcommand,...

CVE-2026-68502

The CVE affects the LazyOwn RedTeam/APT Framework. Prior to version 0.2.154, lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, which reaches LazyOwnShell.do_cmd and invokes subprocess.call(command, shell=True). This all...

EUVD-2026-51307

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get'value' to LazyOwnShell.onecmd, reaching LazyOwnShell.docmd and subprocess.callcommand,...

Security Bulletin: Multiple Security vulnerabilities impacting watsonx.data integration

Summary Multiple Security vulnerabilities impacting watsonx.data integration. These vulnerabilities have been addressed and customers should update to version 5.3.1 at the earliest opportunity. Vulnerability Details CVEID:CVE-2026-33151 DESCRIPTION: Socket.IO is an open source, real-time,...

K000162691: Perl IO::Compress vulnerability CVE-2026-48962

Security Advisory Description IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob wraps the caller-supplied output glob string in double quotes and stores it in the parser state; getFiles then runs the...

CVE-2026-64498

A flaw was found in the Linux kernel's Industrial I/O IIO subsystem, specifically within the hardware consumer buffer hw-consumer. Due to an oversight in memory management, a dedicated memory region scanmask was not properly released when its associated buffer was freed. A local attacker with low...

PT-2026-66608

Name of the Vulnerable Software and Affected Versions LazyOwn RedTeam/APT Framework versions prior to 0.2.154 Description LazyOwn is an AI-powered C2 and red-team operations framework. The lazyc2.py component registers an unauthenticated Socket.IO input event handler that dispatches the value...