UBUNTU-CVE-2026-64090

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 "batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs" added checks to the local direct TT response code. But the response can also be done...

UBUNTU-CVE-2026-53371

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

ROOT-APP-NPM-NSWG-ECO-516 NSWG-ECO-516 in @rootio/lodash - Patched by Root

Root has patched NSWG-ECO-516 in the @rootio/lodash package for Root:npm. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-12064 CVE-2026-12064 in rootio-curl - Patched by Root

Root has patched CVE-2026-12064 in the rootio-curl package for Root:Debian:11. Multiple fixed versions available...

PYSEC-2026-3045 Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

Impact A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payloa...

ROOT-APP-PYPI-CVE-2023-30798 CVE-2023-30798 in rootio-starlette - Patched by Root

Root has patched CVE-2023-30798 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-8932 CVE-2026-8932 in rootio-curl - Patched by Root

Root has patched CVE-2026-8932 in the rootio-curl package for Root:Debian:13. Multiple fixed versions available...

RHSA-2026:36617 Red Hat Security Advisory: oci-seccomp-bpf-hook security update

Bulletin has no description...

PYSEC-2026-1241 ChangeDetection.io XSS in watch overview

Impact XSS - Errors in filters from website page change detection watches were not being filtered. Patches 0.50.4...

Important: python3.14

Issue Overview: tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the...

ROOT-APP-NPM-CVE-2025-54798 CVE-2025-54798 in @rootio/tmp - Patched by Root

Root has patched CVE-2025-54798 in the @rootio/tmp package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22731 CVE-2026-22731 in io.root.org.springframework.boot:spring-boot-starter-actuator - Patched by Root

Root has patched CVE-2026-22731 in the io.root.org.springframework.boot:spring-boot-starter-actuator package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-35728 CVE-2020-35728 in io.root.com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-35728 in the io.root.com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-36179 CVE-2020-36179 in io.root.com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-36179 in the io.root.com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

CVE-2026-46490 samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elemen...

RHSA-2026:23470 Red Hat Security Advisory: kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_40_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update

Bulletin has no description...

ROOT-APP-NPM-CVE-2026-44990 CVE-2026-44990 in @rootio/sanitize-html - Patched by Root

Root has patched CVE-2026-44990 in the @rootio/sanitize-html package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-31129 CVE-2022-31129 in @rootio/moment - Patched by Root

Root has patched CVE-2022-31129 in the @rootio/moment package for Root:npm. Multiple fixed versions available...

CVE-2026-10115 Open5GS Shared NF-profile nnrf-handler.c denial of service

A vulnerability was identified in Open5GS up to 2.7.7. This affects an unknown part in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available and might be...

CLSA-2026-1779129362 Fix CVE(s): CVE-2026-45186

SECURITY UPDATE: fix quadratic complexity in attribute name collision check - debian/patches/CVE-2026-45186.patch: fix quadratic complexity in attribute name collision check - CVE-2026-45186...