ROOT-OS-DEBIAN-13-CVE-2026-19445 CVE-2026-19445 in python3.13 - Patched by Root

Root has patched CVE-2026-19445 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ipg (0.2.0), ipg-cng (>=0.1.1, <=0.1.2) potentially affected by unknown CVE via ic-cipher (0.2.7)

ic-cipher CARGO version 0.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on ic-cipher and may be impacted: - ipg 0.2.0 - ipg-cng =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0337...

BIT-THRIFT-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94639 Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

BIT-THRIFT-2026-66837 Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length

Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-PYTHON-MIN-2026-19445 Use-after-free of a server-side SSLContext when sni_callback switches contexts

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

ROOT-APP-MAVEN-CVE-2026-71497 CVE-2026-71497 in org.jsoup:jsoup - Patched by Root

Root has patched CVE-2026-71497 in the org.jsoup:jsoup package for Root:Maven. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-56000 CVE-2026-56000 in xorg-server - Patched by Root

Root has patched CVE-2026-56000 in the xorg-server package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-55999 CVE-2026-55999 in xorg-server - Patched by Root

Root has patched CVE-2026-55999 in the xorg-server package for Root:Debian:11. Multiple fixed versions available...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0, <=1.1.0), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +3390 more potentially affected by CVE-2026-108039 via org.apache.cxf:cxf-core (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-core MAVEN version =3.0.0, =1.0.0, =1.11.0, =1.11.0, =1.0.0, =11.4-37, =3.6.1, =3.11.0, =3.19.0 and more Source cves: CVE-2026-108039 Source advisory: MEND:CVE-2026-108039...

org.apache.cxf.systests:cxf-systests-transport-netty (>=3.5.7, <=3.6.3), org.apache.cxf:apache-cxf (>=3.0.0, <=3.6.12) +1 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =3.0.0, =3.5.7, =3.0.0, =3.0.0, =3.6.12 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

kr.jclab.wsman:abstract-wsman (>=0.0.1-rc2, <=0.0.1-rc4), kr.jclab.wsman:abstract-wsman-netty (>=0.0.2-rc1, <=0.0.4) +3 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.0.0, =0.0.1-rc2, =0.0.2-rc1, =4.0.2, =4.0.0, =4.0.0, =4.1.8 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

com.savoirtech.aetos:aetos (>=4.2.0.1, <=4.3.1), com.treelogic-swe:aws-mock (1.0) +141 more potentially affected by CVE-2026-97468 via org.apache.cxf.services.sts:cxf-services-sts-core (>=2.5.0, <=3.6.12)

org.apache.cxf.services.sts:cxf-services-sts-core MAVEN version =2.5.0, =4.2.0.1, =ec2-2013-02-01, =7.2.0, =6.3.0, =1.2.0, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.7, =1.0.7, =1.0.0, =1.0.2 and more Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

io.quarkiverse.cxf:quarkus-cxf-integration-test-ws-trust (>=3.35.0, <=4.0.0.beta1), io.quarkiverse.cxf:quarkus-cxf-services-sts (>=3.35.0, <=4.0.0.beta1) +8 more potentially affected by CVE-2026-97468 via org.apache.cxf.services.sts:cxf-services-sts-core (>=4.2.0, <=4.2.3)

org.apache.cxf.services.sts:cxf-services-sts-core MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

br.com.esec.icpm:certillion-client-library (>=1.1.7, <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9, <=1.1.10) +364 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=2.1.10, <=3.6.12)

org.apache.cxf:cxf-rt-ws-security MAVEN version =2.1.10, =1.1.7, =1.1.9, =1.2.5, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), io.camelbee:camelbee-quarkus-core (3.2.1) +52 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.2.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.0.0.beta1 and more Source cves: CVE-2026-97468 Source advisory: MEND:CVE-2026-97468...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), cv.igrp:igrp-core (>=2.0.0.231123-rc1, <=2.0.0.240307-rc2) +115 more potentially affected by CVE-2026-97468 via org.apache.cxf:cxf-rt-ws-security (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-ws-security MAVEN version =4.0.0, =1.0.0, =2.0.0.231123-rc1, =4.0.2, =2.4.0, =1.3, =1.3, =1.3, =1.3, =1.3, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =3.33.14 - io.quarkiverse.cxf:quarkus-cxf-integration-test-ws-security-policy-fips 3.8.1 and more Source cves:...

com.araguacaima.braas:braas-core (1.2), com.araguacaima:commons-utils (>=1.0.1, <=1.5.17) +274 more potentially affected by CVE-2026-86463 via org.apache.cxf:cxf-rt-rs-extension-search (>=2.6.0, <=3.6.12)

org.apache.cxf:cxf-rt-rs-extension-search MAVEN version =2.6.0, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.2, =0.7, =0.7, =0.2, =0.1, =0.0.2, =1.0.0, =1.0.0, =1.1.9 and more Source cves: CVE-2026-86463 Source advisory: MEND:CVE-2026-86463...

com.github.arucard21.simplyrestful:deploy-jetty-cxf (>=1.0.0, <=1.1.0), com.github.arucard21.simplyrestful:deploy-springboot-cxf (>=1.0.0, <=1.1.0) +88 more potentially affected by CVE-2026-86463 via org.apache.cxf:cxf-rt-rs-extension-search (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-rs-extension-search MAVEN version =4.0.0, =1.0.0, =1.0.0, =0.165, =1.1.0-rc1, =4.8.2, =4.10.7, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0-m0, =4.0.0, =4.0.0-m0, =4.1.3 and more Source cves: CVE-2026-86463 Source advisory: MEND:CVE-2026-86463...