ROOT-OS-UBUNTU-2404-CVE-2025-38155 CVE-2025-38155 in rootio-linux - Patched by Root

Root has patched CVE-2025-38155 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-40281 CVE-2025-40281 in rootio-linux - Patched by Root

Root has patched CVE-2025-40281 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-68179 CVE-2025-68179 in rootio-linux - Patched by Root

Root has patched CVE-2025-68179 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-22120 CVE-2025-22120 in rootio-linux - Patched by Root

Root has patched CVE-2025-22120 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-40282 CVE-2025-40282 in rootio-linux - Patched by Root

Root has patched CVE-2025-40282 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-31628 CVE-2026-31628 in rootio-linux - Patched by Root

Root has patched CVE-2026-31628 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

OESA-2026-3012 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...

PT-2026-61269

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memfd component where the SEAL WRITE seal is implied when SEAL EXEC is added to enforce W^X Write XOR Execute, a security policy ensuring memory is either writable...

PT-2026-61229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfrm ESP out-of-place fast path where the esp output head function appends the trailer before esp output tail allocates the destination page frag. The head-side ga...

PT-2026-61391

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the statmount mnt idmap function. The function uses seq printf to write a mapping and manually increments seq-count to include a NUL separator. If seq...

Updated bind packages fix a security vulnerability

The updated bind packages fix a security vulnerability: When BIND 9 was configured to use DNS64 and encounters a DNAME redirect, it could end up using freed memory for the DNS response owner name. This caused the response to contain corrupted data...

Security update for lux (important)

openSUSE security update: security update for lux ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21367-1 Rating: important References: bsc1235304 bsc1241766 bsc1251460 bsc1251627 bsc1267110 Cross-References: CVE-2024-45338 CVE-2025-22872...

CVE-2026-53727 css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`

cssparser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parserreadremotefile in lib/cssparser/parser.rb, and therefore loaduri! and the @import-following branch of addblock!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering...

CVE-2026-48015 Shopware: Stored XSS via SVG file upload — no SVG sanitization

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowedextensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from...

ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-49978 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry PDE mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a...

ROOT-APP-MAVEN-CVE-2025-14813 CVE-2025-14813 in io.root.org.bouncycastle:bcprov-jdk18on - Patched by Root

Root has patched CVE-2025-14813 in the io.root.org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...

RHEL 7 : kernel-rt (RHSA-2026:41236)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41236 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

CVE-2026-33434 Wazuh: Rate Limit Bypass via /events Endpoint

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When t...

CVE-2026-44019

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that acce...