CVE-2026-55251

The NetBox Device Type Library is vulnerable to arbitrary code execution on its CI runner. A contributor with no special repository access could open a pull request modifying requirements.txt , .pre-commit-hooks-config.yaml / .pre-commit-yamlfmt-config.yaml , or .gitmodules files. The CI workflow...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +420 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.0.0-rc1, <=3.1.5)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.42.4, =1.9.0-rc.1, =1.9.0-rc.11 and more Source cves: CVE-2026-68496 Source advisory: SNYK:JAVA-TOOLSJACKSONDATAFORMAT-20416726...

ROOT-APP-MAVEN-CVE-2026-68525 CVE-2026-68525 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-68525 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65905 CVE-2026-65905 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65905 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65182 CVE-2026-65182 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65182 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1790878902 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 10 @react-native-community packages to address 1 CVE. Fixed in 13.6.8-tuxcare.1...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CLSA-2026-1790878081 TuxCare security update for @react-native-community/cli-debugger-ui (1 CVE)

TuxCare rebuilt @react-native-community/cli-debugger-ui to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1...

CLSA-2026-1790876846 TuxCare security update for got (1 CVE)

TuxCare rebuilt got to address 1 CVE. Fixed in 7.1.0-tuxcare.1...

CLSA-2026-1790876611 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.3...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

ai.timefold.solver:timefold-solver-migration (>=1.7.0, <=1.23.0), com.alibaba.fastjson2:fastjson2-extension-spring5 (>=2.0.43, <=2.0.58) +1084 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.16.0, =1.7.0, =2.0.43, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =0.0.3, =0.0.3, =1.41.0, =1.49.1, =1.49.1, =1.50.6 and more Source cves: CVE-2026-68496 Source advisory: MEND:CVE-2026-68496...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.webauthn4j:webauthn4j-appattest (>=0.31.9.release, <=0.31.10.release) +393 more potentially affected by CVE-2026-68495 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.2.0, =1.43.1, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.2 and more Source cves:...

CLSA-2026-1790875447 TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.16-tuxcare.1...

CVE-2023-54404 Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the...

agatta (>=1.0.0, <=1.0.2), agentbuddy (0.1.1.dev33) +102 more potentially affected by CVE-2026-102999 via pypdf (3.17.4)

pypdf PYPI version 3.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =1.0.0, =0.0.3, =0.0.1, =1.1.0, =0.0.2, =1.2.0, =0.6.7, =1.2.1, =0.1.3, =0.0.1, =0.8.2 - cadenai 0.1.0 and more Source cves: CVE-2026-102999...