13341 matches found
CVE-2026-58251
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny...
CVE-2026-59948 Composer: Arbitrary file write outside vendor via malicious transitive package name
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...
CVE-2026-59948
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...
CVE-2026-59948
CVE-2026-59948 affects Composer (PHP dependency manager). A malicious package from an untrusted repo (not Packagist.org/Private Packagist) with an invalid name could cause install/update to write attacker-controlled files outside the vendor directory and project. Root cause: failure to validate t...
CVE-2026-59946
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...
CVE-2026-59946 Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...
CVE-2026-14373 Nomad Docker driver Linux host namespace bypass
HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on...
CVE-2026-14373
HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on...
DEBIAN-CVE-2026-59869
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...
CVE-2026-59880 Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such a...
CVE-2026-59877 protobufjs: Denial of Service via infinite loop in .proto option parsing
protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends...
CVE-2026-59869
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...
ROOT-APP-PYPI-CVE-2026-25087 CVE-2026-25087 in rootio-pyarrow - Patched by Root
Root has patched CVE-2026-25087 in the rootio-pyarrow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-28117 CVE-2023-28117 in rootio-sentry-sdk - Patched by Root
Root has patched CVE-2023-28117 in the rootio-sentry-sdk package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-57820 CVE-2025-57820 in @rootio/devalue - Patched by Root
Root has patched CVE-2025-57820 in the @rootio/devalue package for Root:npm. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48776 CVE-2026-48776 in rootio-langgraph-sdk - Patched by Root
Root has patched CVE-2026-48776 in the rootio-langgraph-sdk package for Root:PyPI. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-55577 CVE-2026-55577 in rootio-imagemagick - Patched by Root
Root has patched CVE-2026-55577 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-55595 CVE-2026-55595 in rootio-imagemagick - Patched by Root
Root has patched CVE-2026-55595 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...