ROOT-OS-DEBIAN-12-CVE-2025-39931 CVE-2025-39931 in linux - Patched by Root

Root has patched CVE-2025-39931 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-39961 CVE-2025-39961 in linux - Patched by Root

Root has patched CVE-2025-39961 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2025-39898 CVE-2025-39898 in linux - Patched by Root

Root has patched CVE-2025-39898 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2022-50322 CVE-2022-50322 in linux - Patched by Root

Root has patched CVE-2022-50322 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2024-46820 CVE-2024-46820 in linux - Patched by Root

Root has patched CVE-2024-46820 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-53001 CVE-2026-53001 in linux - Patched by Root

Root has patched CVE-2026-53001 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-34380 CVE-2026-34380 in openexr - Patched by Root

Root has patched CVE-2026-34380 in the openexr package for Root:Debian:12. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-36181 CVE-2020-36181 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-36181 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

Astra Linux – Vulnerability in OpenSSL

AES OCB mode for 32-bit x86 platforms, using the AES-NI assembly-optimized implementation, may not encrypt all of the data under certain circumstances. This could reveal sixteen bytes of data that were already present in the memory but were not written. In the special case of “in-place” encryptio...

Astra Linux – Vulnerability in Consul

HashiCorp Consul and Consul Enterprise 1.10.1: The TXN.Apply endpoint allows for the registration of proxies for other services, enabling access to service traffic. This feature was fixed in versions 1.8.15, 1.9.9, and 1.10.2...

Astra Linux – Vulnerability in Firefox and Thunderbird

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A authenticated user can use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. This issue exists in all versions of Redis that support L...

CVE-2026-69127 Kirby: System path exposure from error messages in the REST API

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

SUSE CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

CVE-2026-66059

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-45415

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csvcensus/censuslogs record-management endpoints do not enforce full administrator authorization before rendering or mutating Decidim::Verifications::CsvDatu...

CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

CVE-2026-71434 Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, so an unauthenticated visitor could upload file types an administrator had intended to disallow...

CVE-2026-71326

CVE-2026-71326 affects Traefik’s BasicAuth middleware (pkg/middlewares/auth/basic_auth.go) in 3.6.11–3.6.25 and 3.7.10. The vulnerability arises from deduplicating concurrent password checks using a singleflight key built from the delimiter-free concatenation of password and secret, enabling an a...