ROOT-OS-ALPINE-322-CVE-2026-3441 CVE-2026-3441 in binutils - Patched by Root

Root has patched CVE-2026-3441 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-3442 CVE-2026-3442 in binutils - Patched by Root

Root has patched CVE-2026-3442 in the binutils package for Root:Alpine:3.22. Multiple fixed versions available...

CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

ROOT-APP-PYPI-CVE-2026-23490 CVE-2026-23490 in pyasn1 - Patched by Root

Root has patched CVE-2026-23490 in the pyasn1 package for Root:PyPI. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-11824 CVE-2026-11824 in sqlite - Patched by Root

Root has patched CVE-2026-11824 in the sqlite package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-11822 CVE-2026-11822 in sqlite - Patched by Root

Root has patched CVE-2026-11822 in the sqlite package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-45292 CVE-2026-45292 in io.opentelemetry:opentelemetry-api - Patched by Root

Root has patched CVE-2026-45292 in the io.opentelemetry:opentelemetry-api package for Root:Maven. Multiple fixed versions available...

SUSE CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

Linux Distros Unpatched Vulnerability : CVE-2026-45084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0 through 3.6.5 contain a denial of service vulnerability in the presence...

CVE-2026-71318

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

EUVD-2026-53658

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated POST...

CVE-2026-71320

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

EUVD-2026-53647

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

EUVD-2026-53611

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameter...

CVE-2026-70612

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-55522 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow.executeinclude implicitly imports and runs an included recipe's tools.py via a raw...

CVE-2026-55522 PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow.executeinclude implicitly imports and runs an included recipe's tools.py via a raw...

CVE-2026-55522

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow.executeinclude implicitly imports and runs an included recipe's tools.py via a raw...

CVE-2026-70610

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

CVE-2026-70610

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...