DEBIAN-CVE-2026-59869

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

CVE-2026-59880 Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such a...

CVE-2026-59877 protobufjs: Denial of Service via infinite loop in .proto option parsing

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends...

CVE-2026-59869

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

ROOT-APP-PYPI-CVE-2026-25087 CVE-2026-25087 in rootio-pyarrow - Patched by Root

Root has patched CVE-2026-25087 in the rootio-pyarrow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-28117 CVE-2023-28117 in rootio-sentry-sdk - Patched by Root

Root has patched CVE-2023-28117 in the rootio-sentry-sdk package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-57820 CVE-2025-57820 in @rootio/devalue - Patched by Root

Root has patched CVE-2025-57820 in the @rootio/devalue package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48776 CVE-2026-48776 in rootio-langgraph-sdk - Patched by Root

Root has patched CVE-2026-48776 in the rootio-langgraph-sdk package for Root:PyPI. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-55577 CVE-2026-55577 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-55577 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-56365 CVE-2026-56365 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-56365 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-55594 CVE-2026-55594 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-55594 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-55595 CVE-2026-55595 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-55595 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-55628 CVE-2026-55628 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-55628 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-53467 CVE-2026-53467 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-53467 in the rootio-imagemagick package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-55431

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...

CVE-2026-55438

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the...

EUVD-2026-42135

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob...

PT-2026-56584

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

PT-2026-56561

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.14.1 NATS Server versions prior to 2.12.9 Description An MQTT client can include protocol control characters in subscription filters. These characters are subsequently forwarded as NATS protocol data to route or...

CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder config-ssh wrote server-supplied SSH settings HostnameSuffix, SSHConfigOptions into the user's /.ssh/config without sanitizing embedded newlines or...