CVE-2026-126766

OpsTree REMS versions through 1.0.0 are affected by an improper authorization vulnerability (CWE-639) regarding incident reporting. An authenticated user can spoof a reporter's identity by supplying a client-controlled reporter field within crafted POST /api/v1/incidents or PATCH /api/v1/incident...

EUVD-2026-123671

OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/id/status request...

ROOT-APP-NPM-CVE-2026-33891 CVE-2026-33891 in node-forge - Patched by Root

Root has patched CVE-2026-33891 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-66030 CVE-2025-66030 in node-forge - Patched by Root

Root has patched CVE-2025-66030 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-12816 CVE-2025-12816 in node-forge - Patched by Root

Root has patched CVE-2025-12816 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2024-32020 CVE-2024-32020 in git - Patched by Root

Root has patched CVE-2024-32020 in the git package for Root:Debian:11. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54518 CVE-2026-54518 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54518 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54513 CVE-2026-54513 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54513 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

Important: Red Hat Security Advisory: flatpak-builder security update

An update for flatpak-builder is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

ROOT-APP-MAVEN-GHSA-R7WM-3CXJ-WFF9 GHSA-r7wm-3cxj-wff9 in com.fasterxml.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-r7wm-3cxj-wff9 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

pintheft

PinTheft — RDS zerocopy double-free LPE tracking site Source for the PinTheft patch-status tracker: a single-page site recording which distributions have shipped a fix for the RDS zerocopy double-free privilege escalation in the Linux kernel. Where the facts live Everything about the bug — CVE ID...

Important: Red Hat Security Advisory: flatpak-builder security update

An update for flatpak-builder is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

ROOT-APP-PYPI-CVE-2026-50269 CVE-2026-50269 in aiohttp - Patched by Root

Root has patched CVE-2026-50269 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-69227 CVE-2025-69227 in aiohttp - Patched by Root

Root has patched CVE-2025-69227 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-53643 CVE-2025-53643 in aiohttp - Patched by Root

Root has patched CVE-2025-53643 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-69244 CVE-2026-69244 in aiohttp - Patched by Root

Root has patched CVE-2026-69244 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

dlink

Command Injection and Backdoor Account in D-Link NAS Devices Vulnerability Summary: The described vulnerability affects multiple D-Link NAS devices, including models DNS-340L, DNS-320L, DNS-327L, and DNS-325, among others. The vulnerability lies within the nassharing.cgi uri, which is vulnerable...

CVE-2025-70341

CVE-2025-70341: Insecure Permissions + Arbitrary Code Execution in App-Auto-Patch Summary App-Auto-Patch v3.4.2 creates its working directory with world-writable permissions chmod 777, enabling a local TOCTOU time-of-check-time-of-use race condition. An unprivileged local attacker can exploit thi...