CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

EUVD-2026-91045

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-55251

The NetBox Device Type Library is vulnerable to arbitrary code execution on its CI runner. A contributor with no special repository access could open a pull request modifying requirements.txt , .pre-commit-hooks-config.yaml / .pre-commit-yamlfmt-config.yaml , or .gitmodules files. The CI workflow...

org.webjars.npm:micromark-extension-math (3.1.0), org.webjars.npm:remark-math (6.0.0) potentially affected by CVE-2026-103923 via org.webjars.npm:katex (0.16.47)

org.webjars.npm:katex MAVEN version 0.16.47 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:katex and may be impacted: - org.webjars.npm:micromark-extension-math 3.1.0 - org.webjars.npm:remark-math 6.0.0 Source cves: CVE-2026-103923...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +420 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.0.0-rc1, <=3.1.5)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.42.4, =1.9.0-rc.1, =1.9.0-rc.11 and more Source cves: CVE-2026-68496 Source advisory: SNYK:JAVA-TOOLSJACKSONDATAFORMAT-20416726...

ROOT-APP-MAVEN-CVE-2026-68525 CVE-2026-68525 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-68525 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65905 CVE-2026-65905 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65905 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65182 CVE-2026-65182 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65182 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

citizenk (0.1.67), confluent-kafka-config (1.1.4) +40 more potentially affected by CVE-2026-15911 via confluent-kafka (>=2.6.2, <=2.14.2)

confluent-kafka PYPI version =2.6.2, =0.1.0, =1.34.3, =0.5.11, =0.1.6, =0.11.0, =0.1.0, =0.9.0, =1.0.0, =1.3.2, =0.4.0, =0.0.1, =5.7.157, =0.0.14, =0.3.0 and more Source cves: CVE-2026-15911 Source advisory: MEND:CVE-2026-15911...

CLSA-2026-1790878902 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 9 @react-native-community packages to address 1 CVE. Fixed in 13.6.8-tuxcare.1...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CLSA-2026-1790878081 TuxCare security update for @react-native-community/cli-debugger-ui (1 CVE)

TuxCare rebuilt @react-native-community/cli-debugger-ui to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1...

CLSA-2026-1790876846 TuxCare security update for got (1 CVE)

TuxCare rebuilt got to address 1 CVE. Fixed in 7.1.0-tuxcare.1...

CLSA-2026-1790876611 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.3...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

ai.timefold.solver:timefold-solver-migration (>=1.7.0, <=1.23.0), com.alibaba.fastjson2:fastjson2-extension-spring5 (>=2.0.43, <=2.0.58) +1084 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.16.0, =1.7.0, =2.0.43, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =0.0.3, =0.0.3, =1.41.0, =1.49.1, =1.49.1, =1.50.6 and more Source cves: CVE-2026-68496 Source advisory: MEND:CVE-2026-68496...