DEBIAN-CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

org.http4k:http4k-aws (3.213.0), org.http4k:http4k-client-apache (3.213.0) +32 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.213.0)

org.http4k:http4k-core MAVEN version 3.213.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.213.0 - org.http4k:http4k-client-apache 3.213.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.231.0), org.http4k:http4k-client-apache (3.231.0) +18 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.231.0)

org.http4k:http4k-core MAVEN version 3.231.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.231.0 - org.http4k:http4k-client-apache 3.231.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.224.0), org.http4k:http4k-client-apache (3.224.0) +32 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.224.0)

org.http4k:http4k-core MAVEN version 3.224.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.224.0 - org.http4k:http4k-client-apache 3.224.0 - org.http4k:http4k-client-apache-async...

CVE-2026-59712 Leantime - JSON-RPC API Broken Access Control via users.getUser

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-54282 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-24...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-54282 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

bocadillo (>=0.12.3, <=0.14.2), starlette-jsonrpc (>=0.1.0, <=0.2.0) +2 more potentially affected by CVE-2026-54282 via starlette (0.11.4)

starlette PYPI version 0.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bocadillo =0.12.3, =0.1.0, =0.1.0, =0.11.0 - termpair 0.0.0.2 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

org.http4k:http4k-aws (3.199.0), org.http4k:http4k-client-apache (3.199.0) +32 more potentially affected by CVE-2026-100725 via org.http4k:http4k-core (3.199.0)

org.http4k:http4k-core MAVEN version 3.199.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.199.0 - org.http4k:http4k-client-apache 3.199.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-api-graphql (5.44.0.0), org.http4k:http4k-api-jsonrpc (5.44.0.0) +180 more potentially affected by unknown CVE via org.http4k:http4k-core (5.44.0.0)

org.http4k:http4k-core MAVEN version 5.44.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-api-graphql 5.44.0.0 - org.http4k:http4k-api-jsonrpc 5.44.0.0 - org.http4k:http4k-api-jsonsche...

org.http4k:http4k-api-graphql (5.42.0.0), org.http4k:http4k-api-jsonrpc (5.42.0.0) +178 more potentially affected by unknown CVE via org.http4k:http4k-core (5.42.0.0)

org.http4k:http4k-core MAVEN version 5.42.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-api-graphql 5.42.0.0 - org.http4k:http4k-api-jsonrpc 5.42.0.0 - org.http4k:http4k-api-jsonsche...

org.http4k:http4k-aws (3.247.0), org.http4k:http4k-client-apache (3.247.0) +25 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.247.0)

org.http4k:http4k-core MAVEN version 3.247.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.247.0 - org.http4k:http4k-client-apache 3.247.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.199.0), org.http4k:http4k-client-apache (3.199.0) +32 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.199.0)

org.http4k:http4k-core MAVEN version 3.199.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.199.0 - org.http4k:http4k-client-apache 3.199.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.128.0), org.http4k:http4k-client-apache (3.128.0) +31 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.128.0)

org.http4k:http4k-core MAVEN version 3.128.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.128.0 - org.http4k:http4k-client-apache 3.128.0 - org.http4k:http4k-client-apache-async...

org.http4k.pro:http4k-incubator-db (v6.3.0.0), org.http4k.pro:http4k-mcp-sdk (v6.3.0.0) +173 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (v6.3.0.0)

org.http4k:http4k-core MAVEN version v6.3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.3.0.0 - org.http4k.pro:http4k-mcp-sdk v6.3.0.0 -...

org.http4k.pro:http4k-incubator-db (v6.4.1.0), org.http4k.pro:http4k-mcp-sdk (v6.4.1.0) +173 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (v6.4.1.0)

org.http4k:http4k-core MAVEN version v6.4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k.pro:http4k-incubator-db v6.4.1.0 - org.http4k.pro:http4k-mcp-sdk v6.4.1.0 -...

org.http4k:http4k-aws (3.221.0), org.http4k:http4k-client-apache (3.221.0) +32 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.221.0)

org.http4k:http4k-core MAVEN version 3.221.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.221.0 - org.http4k:http4k-client-apache 3.221.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.224.0), org.http4k:http4k-client-apache (3.224.0) +32 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.224.0)

org.http4k:http4k-core MAVEN version 3.224.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.224.0 - org.http4k:http4k-client-apache 3.224.0 - org.http4k:http4k-client-apache-async...

org.http4k:http4k-aws (3.157.1), org.http4k:http4k-client-apache (3.157.1) +31 more potentially affected by CVE-2026-100724 via org.http4k:http4k-core (3.157.1)

org.http4k:http4k-core MAVEN version 3.157.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.157.1 - org.http4k:http4k-client-apache 3.157.1 - org.http4k:http4k-client-apache-async...

bootleg (1.1.0), cyberbrain (0.2.3) +6 more potentially affected by CVE-2026-54911 via ujson (4.1.0)

ujson PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - bootleg 1.1.0 - cyberbrain 0.2.3 - dataplate =0.2.0, =4.2.0, =0.7.0, =0.3.3, =0.2.0, =0.2.1 Source cves: CVE-2026-54911 Source advisory:...