May 2026 Security Advisory Ivanti Virtual Traffic Manager (vTM) (CVE-2026-8051)

Summary Ivanti has released updates for Ivanti Virtual Traffic Manager which addresses one High severity vulnerability. Successful exploitation could lead to admin authenticated remote code execution. We are not aware of any customers being exploited by this vulnerability at the time of disclosur...

May 2026 Security Advisory Ivanti Secure Access Client (CVE-2026-7431, CVE-2026-7432)

Update 22 May: CVE-2026-8992 has been added to Vulnerability Details Summary Ivanti has released updates for the Ivanti Secure Access Client which addresses one medium severity vulnerability and two High severity vulnerabilities. We are not aware of any customers being exploited by these...

Security Advisory - Ivanti Xtraction (CVE-2026-8043)

Summary Ivanti has released an update for Ivanti Xtraction which addresses one Critical severity vulnerability. Successful exploitation could lead to sensitive information disclosure and client-side attacks. We are not aware of any customers being exploited by this vulnerability at the time of...

ROOT-APP-PYPI-CVE-2026-32597 CVE-2026-32597 in PyJWT - Patched by Root

Root has patched CVE-2026-32597 in the PyJWT package for Root:PyPI. Multiple fixed versions available...

flatpak-builder security update

An update is available for flatpak-builder. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Flatpak-builder is a tool for building flatpaks from sources. Securi...

RLSA-2026:98642 Important: flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git-am CVE-2026-86320 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

ROOT-APP-MAVEN-CVE-2026-45416 CVE-2026-45416 in io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-45416 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54518 CVE-2026-54518 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54518 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-54513 CVE-2026-54513 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-54513 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-44173 CVE-2026-44173 in mariadb - Patched by Root

Root has patched CVE-2026-44173 in the mariadb package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-126949

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database...

CVE-2026-126946

Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via...

ROOT-APP-NPM-CVE-2022-0235 CVE-2022-0235 in node-fetch - Patched by Root

Root has patched CVE-2022-0235 in the node-fetch package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65905 CVE-2026-65905 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65905 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43512 CVE-2026-43512 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43512 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-126946

Zipline versions 4.3.0 before 4.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw in SSR meta tags. The root cause is the failure to escape input for embed settings , specifically the embedTitle, embedDescription, embedSiteName, and embedColor fields. Authenticated low-privilege user...

EUVD-2026-125119

Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via...

EUVD-2026-125117

Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete ...

CVE-2026-126948

Zipline versions prior to 4.5.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). The root cause is a missing ownership verification within the PATCH and DELETE handlers for the /api/user/folders/:id endpoints. An authenticated attacker can exploit this by sup...

EUVD-2026-125116

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database...