ROOT-APP-PYPI-CVE-2026-54279 CVE-2026-54279 in aiohttp - Patched by Root

Root has patched CVE-2026-54279 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-MV93-W799-CJ2W GHSA-mv93-w799-cj2w in GitPython - Patched by Root

Root has patched GHSA-mv93-w799-cj2w in the GitPython package for Root:PyPI. Multiple fixed versions available...

MINI-CP45-MGMJ-5M2W

Bulletin has no description...

MINI-J668-XGFG-62G6

Bulletin has no description...

MINI-4823-MJ8P-656R

Bulletin has no description...

MINI-R24F-FGGX-HMCX

Bulletin has no description...

MINI-6HHW-WW2X-GH6W

Bulletin has no description...

MINI-CJR3-JJ73-C6MM

Bulletin has no description...

MAL-2026-11709 Malicious code in @or-sdk/library-types-v1 (npm)

npm/@or-sdk/library-types-v1 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11640 Malicious code in @onereach/si-list (npm)

npm/@onereach/si-list is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

DEBIAN-CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

ROOT-APP-NPM-CVE-2021-3795 CVE-2021-3795 in semver-regex - Patched by Root

Root has patched CVE-2021-3795 in the semver-regex package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-26133 CVE-2023-26133 in progressbar.js - Patched by Root

Root has patched CVE-2023-26133 in the progressbar.js package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-24999 CVE-2022-24999 in qs - Patched by Root

Root has patched CVE-2022-24999 in the qs package for Root:npm. Multiple fixed versions available...

Oliver 5 Library Server <8.00.008.053 - Local File Inclusion

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function. id: CVE-2021-45027 info: name: Oliver 5 Library Server 8.00.008.053 - Local File Inclusion author: gy741 severity: high description: Oliver 5 Library Server versions prior t...

WordPress Media Library Assistant <= 3.34 - SQL Injection

David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...

Php-mod/curl Library <2.3.2 - Cross-Site Scripting

Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the postfilepathupload.php key parameter and the POST data to postmultidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other...

MicroStrategy Library <11.1.3 - Cross-Site Scripting

MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Slims9 Bulian 9.4.2 - SQL Injection

Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained. id: CVE-2021-45793 info: name: Slims9 Bulian 9.4.2 - SQL Injection author: nblirwn severity: high description: | Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data c...

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. id: CVE-2020-11732 info: name: Media Library Assistant 2.82 -...