ROOT-APP-NPM-CVE-2025-1647 CVE-2025-1647 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2019-8331 CVE-2019-8331 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2019-8331 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2024-10105 AIKIDO-2024-10105 in @rootio/pug - Patched by Root

Root has patched AIKIDO-2024-10105 in the @rootio/pug package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-36361 CVE-2024-36361 in @rootio/pug - Patched by Root

Root has patched CVE-2024-36361 in the @rootio/pug package for Root:npm. Multiple fixed versions available...

PT-2026-60566

Name of the Vulnerable Software and Affected Versions cert-manager versions 1.18.0 through 1.19.5 cert-manager versions 1.20.0 through 1.20.2 Description Namespace users can create Challenge resources under acme.cert-manager.io without admission validation that ties the Challenge to an Order, own...

CVE-2026-48795

Summary (CVE-2026-48795): AdonisJS’s bodyparser (/@adonisjs/bodyparser) has an incomplete fix for CVE-2026-25754 in certain pre-release ranges. The issue arises in nested multipart/form-data payloads (for example involving proto or constructor.prototype) that allow lodash _.set() through @poppins...

CVE-2026-45738

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...

CVE-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...

CVE-2026-56742

Cilium Gateway API vulnerability (CVE-2026-56742): Prior to versions 1.17.17, 1.18.11, and 1.19.5, clusters using Gateway API allowed users with write permissions on namespaced HTTPRoutes to mirror traffic to any Service in any namespace, bypassing ReferenceGrant checks. Impacted when Gateway API...

CVE-2026-49445

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

CVE-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

CVE-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

SUSE CVE-2025-6013

Vault and Vault Enterprise's “Vault” ldap auth method may not have correctly enforced MFA if usernameasalias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and...

SUSE CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

CVE-2026-45793

CVE-2026-45793 affects Composer (PHP dependency manager). Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validated GitHub tokens with ^[.A-Za-z0-9_]+$ and interpolated rejected tokens into an UnexpectedValueException. GitHub Actions GITHUB_TOKEN values formatted as g...

EUVD-2026-44704

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's norm...

EUVD-2026-44701

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by...

CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by...

ROOT-APP-NPM-CVE-2026-2327 CVE-2026-2327 in @rootio/markdown-it - Patched by Root

Root has patched CVE-2026-2327 in the @rootio/markdown-it package for Root:npm. Multiple fixed versions available...

CVE-2026-56353

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth a non-default configuration. In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented,...