GO-2026-6554 OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao

OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao...

CVE-2026-55251

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-53964

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

EUVD-2026-91047

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

CVE-2026-53964 Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

CVE-2026-53964 Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

CVE-2026-53964

The Document Merge Service is vulnerable to Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in versions prior to 9.1.0 . The flaw exists because the xltpl library uses a non-sandboxed Jinja environment to process XLSX templates . An attacker can supply malicious template con...

CLSA-2026-1790884245 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.3...

CVE-2026-55251

The NetBox Device Type Library is vulnerable to arbitrary code execution on its CI runner. A contributor with no special repository access could open a pull request modifying requirements.txt , .pre-commit-hooks-config.yaml / .pre-commit-yamlfmt-config.yaml , or .gitmodules files. The CI workflow...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

EUVD-2026-91045

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +420 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.0.0-rc1, <=3.1.5)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.42.4, =1.9.0-rc.1, =1.9.0-rc.11 and more Source cves: CVE-2026-68496 Source advisory: SNYK:JAVA-TOOLSJACKSONDATAFORMAT-20416726...

ROOT-APP-MAVEN-CVE-2026-68525 CVE-2026-68525 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-68525 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65182 CVE-2026-65182 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65182 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65905 CVE-2026-65905 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65905 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1790878902 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.8-tuxcare.1...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...