ROOT-APP-PYPI-CVE-2026-21226 CVE-2026-21226 in azure-core - Patched by Root

Root has patched CVE-2026-21226 in the azure-core package for Root:PyPI. Multiple fixed versions available...

CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

ROOT-APP-NPM-CVE-2026-35515 CVE-2026-35515 in @nestjs/core - Patched by Root

Root has patched CVE-2026-35515 in the @nestjs/core package for Root:npm. Multiple fixed versions available...

CVE-2026-68494

This CVE notes an incomplete fix for CVE-2026-18401 in jackson-core’s non-blocking parser, leaving a remaining bypass for number-length constraints when data is streamed in many small chunks. The issue arises in the async parser path (MINOR_NUMBER_INTEGER_DIGITS) where validateIntegerLength() is ...

EUVD-2026-52699

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CVE-2026-18401 jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

CVE-2026-18401

The CVE describes a vulnerability in jackson-core’s non-blocking (async) JSON parser where maxNumberLength is not enforced, unlike the synchronous parser. Root cause: the async parsing path in NonBlockingUtf8JsonParserBase does not invoke number length validation; _finishNumberIntegralPart() accu...

CVE-2026-18766

CVE-2026-18766 affects the chetans9 core-php-admin-panel (up to the commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f). The issue is a SQL injection caused by manipulation of the argument filter_col in customers.php. It can be exploited remotely, and the exploit has been published and may be used. ...

EUVD-2026-52697

A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php. Executing a manipulation of the argument filtercol can lead to sql...

ROOT-APP-MAVEN-GHSA-72HV-8253-57QQ GHSA-72hv-8253-57qq in com.fasterxml.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-72hv-8253-57qq in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-GHSA-R7WM-3CXJ-WFF9 GHSA-r7wm-3cxj-wff9 in com.fasterxml.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-r7wm-3cxj-wff9 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-GHSA-2M67-WJPJ-XHG9 GHSA-2m67-wjpj-xhg9 in tools.jackson.core:jackson-core - Patched by Root

Root has patched GHSA-2m67-wjpj-xhg9 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-29062 CVE-2026-29062 in tools.jackson.core:jackson-core - Patched by Root

Root has patched CVE-2026-29062 in the tools.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...

WordPress WPB Show Core - Cross-Site Scripting

WordPress wpb-show-core plugin through TODO contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site...

WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery

The WPB Show Core WordPress plugin through version 2.2 is vulnerable to Server-Side Request Forgery SSRF via the 'path' parameter in the download-file.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs. id: CVE-2023-5974 info: nam...

Social Login by BestWebSoft < 0.2 - Cross-Site Scripting

The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. id: CVE-2017-18501 info: name: Social Login by BestWebSoft 0.2 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues...

CVE-2026-17614 Wildfly-core: path traversal on wildfly domain controller

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...

EUVD-2026-52511

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...

CVE-2026-11835

Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...