CVE-2025-1302_jsonpath-plus_RCE

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: poc.py A proof-of-concept exploit script for CVE-2025-1302, which targets an RCE vulnerability in the jsonpath-plus library. When run against a vulnerable service endpoint, the script attempts to trigger remote code execution via a JSONPath...

Astra Linux – Vulnerability in SOX

A heap buffer overflow vulnerability was discovered in sox, within the lsxreadbuf function at sox/src/formatsi.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure...

ROOT-APP-NPM-CVE-2026-65902 CVE-2026-65902 in dompurify - Patched by Root

Root has patched CVE-2026-65902 in the dompurify package for Root:npm. Multiple fixed versions available...

DEBIAN-CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

ROOT-OS-DEBIAN-13-CVE-2026-56373 CVE-2026-56373 in imagemagick - Patched by Root

Root has patched CVE-2026-56373 in the imagemagick package for Root:Debian:13. Multiple fixed versions available...

ROOT-APP-COMPOSER-AIKIDO-2026-248927 AIKIDO-2026-248927 in magento/product-community-edition - Patched by Root

Root has patched AIKIDO-2026-248927 in the magento/product-community-edition package for Root:Composer. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-37901 CVE-2025-37901 in linux - Patched by Root

Root has patched CVE-2025-37901 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

MINI-H62M-6JG8-FMXP

Bulletin has no description...

@edgebrix-sdk/react (>=0.0.58, <=0.0.74), @kimia_software/tellair-wc (0.0.0) +16 more potentially affected by CVE-2026-56812 via phoenix (>=1.6.2, <=1.6.16)

phoenix NPM version =1.6.2, =0.0.58, =0.8.10, =0.1.8, =0.1.5, =0.1.0-rc0, =0.8.1, =0.0.1, =0.0.1, =0.0.0-PR-1--182e1d3, =19.0.0-beta.1, =1.0.23, =0.3.0, =0.1.1, =0.1.6 and more Source cves: CVE-2026-56812 Source advisory: OSV:GHSA-63MC-HW7G-86RR...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62681 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-62681 Source advisory: OSV:GHSA-FG9P-MRXR-HVQ7...

CVE-2026-33630

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple poin...

MINI-54RH-V4RQ-6H8P

Bulletin has no description...

CLEANSTART-2026-VV94916 Security fixes in renovate 43.252.8-r3

Package renovate version 43.252.8-r3 fixes 1 vulnerabilities: CVE-2026-13697...

CLEANSTART-2026-EW26972 Security fixes in gradle 7.6.1-r0

Package gradle version 7.6.1-r0 fixes 1 vulnerabilities: CVE-2023-26053...

CLEANSTART-2026-NM54655 Security fixes in newrelic-infrastructure-agent 1.78.1-r4

Package newrelic-infrastructure-agent version 1.78.1-r4 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-CB09847 Security fixes in tigera-operator 1.40.14-r1

Package tigera-operator version 1.40.14-r1 fixes 1 vulnerabilities: CVE-2026-50163...

CLEANSTART-2026-KE44477 Security fixes in langfuse-worker 3.194.1-r2

Package langfuse-worker version 3.194.1-r2 fixes 1 vulnerabilities: ghsa-9mqv-5hh9-4cgg...

@pnpm/building.commands (>=1100.0.0, <=1100.1.8), @pnpm/deps.compliance.commands (>=1100.0.0, <=1101.5.1) +10 more potentially affected by CVE-2026-82393 via @pnpm/installing.deps-resolver (>=1100.0.0, <=1100.2.6)

@pnpm/installing.deps-resolver NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-82393 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSRESOLVER-19477039...

UBUNTU-CVE-2026-55520

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

UBUNTU-CVE-2026-54548

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...