EUVD-2026-33371

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via strings.ReplaceAll with no escaping. The substitution...

CVE-2026-46376 FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel UCP using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP...

ROOT-OS-DEBIAN-12-CVE-2024-57883 CVE-2024-57883 in rootio-linux - Patched by Root

Root has patched CVE-2024-57883 in the rootio-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2024-50032 CVE-2024-50032 in rootio-linux - Patched by Root

Root has patched CVE-2024-50032 in the rootio-linux package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-44849

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that...

EUVD-2026-32908

Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary...

USN-8330-1: OpenJDK 8 vulnerabilities

Thomas Beckers discovered that the JAXP component of OpenJDK 8 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. CVE-2026-22016 It was discovered that the JSSE component of OpenJDK 8 d...

ROOT-OS-UBUNTU-2204-CVE-2023-53657 CVE-2023-53657 in rootio-linux - Patched by Root

Root has patched CVE-2023-53657 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

PT-2026-43298

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn in lua/upload/upload.go uses filepath.Join with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This...

ROOT-OS-UBUNTU-2404-CVE-2025-68364 CVE-2025-68364 in rootio-linux - Patched by Root

Root has patched CVE-2025-68364 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

Chromium: CVE-2026-8521 Use after free in Tab Groups

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

ROOT-APP-PYPI-GHSA-58PV-8J8X-9VJ2 GHSA-58pv-8j8x-9vj2 in rootio-jaraco.context - Patched by Root

Root has patched GHSA-58pv-8j8x-9vj2 in the rootio-jaraco.context package for Root:PyPI. Multiple fixed versions available...

RHSA-2026:19224 Red Hat Security Advisory: vim security update

Bulletin has no description...

RHSA-2026:19177 Red Hat Security Advisory: python3.12 security update

Bulletin has no description...

CVE-2026-33637

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object rather than a String to Faraday::Connectionbuildexclusiveurl. This...

EUVD-2026-30943

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0...

CVE-2026-8963

Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151...

PT-2026-41914

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 151 Thunderbird versions prior to 151 Description A spoofing issue exists in WebExtensions. Recommendations Update to version 151 for Firefox. Update to version 151 for Thunderbird...

Chromium: CVE-2026-8519 Integer overflow in ANGLE

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

UBUNTU-CVE-2026-42578

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage method creates headers using...