CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

ROOT-OS-DEBIAN-13-CVE-2026-59997 CVE-2026-59997 in openssh - Patched by Root

Root has patched CVE-2026-59997 in the openssh package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-60002 CVE-2026-60002 in openssh - Patched by Root

Root has patched CVE-2026-60002 in the openssh package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-63621 Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

CVE-2026-19685

NetworkManager failed to enforce the private_user restriction on the 802-1x.ca-path and phase2-ca-path directory-valued connection properties—an incomplete fix for CVE-2025-9615. An unprivileged local user can point a private WPA-Enterprise (802.1X) profile's CA path at an attacker-controlled dir...

EUVD-2026-64957

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

ROOT-OS-DEBIAN-13-CVE-2025-61147 CVE-2025-61147 in libde265 - Patched by Root

Root has patched CVE-2025-61147 in the libde265 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-49295 CVE-2026-49295 in libde265 - Patched by Root

Root has patched CVE-2026-49295 in the libde265 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-21413 CVE-2026-21413 in libraw - Patched by Root

Root has patched CVE-2026-21413 in the libraw package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-37555 CVE-2026-37555 in libsndfile - Patched by Root

Root has patched CVE-2026-37555 in the libsndfile package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-76844

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

ROOT-APP-MAVEN-CVE-2025-14813 CVE-2025-14813 in org.bouncycastle:bcprov-jdk18on - Patched by Root

Root has patched CVE-2025-14813 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...

Critical: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.0-0.1.1.hum1 aarch64, x8664 grafana13.2-13.2.0-0.1.1.hum1.src src...

CVE-2026-76844

webpack-dev-middleware suffers from a path traversal vulnerability in its getFilenameFromUrl function, an incomplete fix for CVE-2024-29180 . When publicPath is configured without a trailing slash, a crafted request (e.g., GET /assets../.env against publicPath /assets) bypasses the UP_PATH_REGEXP...

CVE-2026-76844 webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

EUVD-2026-64850

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

CVE-2026-76844 webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

Critical: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.3-0.2.hum1 aarch64, x8664 grafana13.1-13.1.3-0.2.hum1.src src...