ROOT-APP-MAVEN-CVE-2020-10683 CVE-2020-10683 in io.root.dom4j:dom4j - Patched by Root

Root has patched CVE-2020-10683 in the io.root.dom4j:dom4j package for Root:Maven. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-43810 CVE-2023-43810 in rootio-opentelemetry-instrumentation - Patched by Root

Root has patched CVE-2023-43810 in the rootio-opentelemetry-instrumentation package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-40151 CVE-2022-40151 in io.root.com.thoughtworks.xstream:xstream - Patched by Root

Root has patched CVE-2022-40151 in the io.root.com.thoughtworks.xstream:xstream package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-41966 CVE-2022-41966 in io.root.com.thoughtworks.xstream:xstream - Patched by Root

Root has patched CVE-2022-41966 in the io.root.com.thoughtworks.xstream:xstream package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-14061 CVE-2020-14061 in io.root.com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-14061 in the io.root.com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-14062 CVE-2020-14062 in io.root.com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-14062 in the io.root.com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-11113 CVE-2020-11113 in io.root.com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-11113 in the io.root.com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33938 CVE-2026-33938 in @rootio/handlebars - Patched by Root

Root has patched CVE-2026-33938 in the @rootio/handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-23383 CVE-2021-23383 in @rootio/handlebars - Patched by Root

Root has patched CVE-2021-23383 in the @rootio/handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-23369 CVE-2021-23369 in @rootio/handlebars - Patched by Root

Root has patched CVE-2021-23369 in the @rootio/handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33940 CVE-2026-33940 in @rootio/handlebars - Patched by Root

Root has patched CVE-2026-33940 in the @rootio/handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-7RX3-28CR-V5WH GHSA-7rx3-28cr-v5wh in @rootio/handlebars - Patched by Root

Root has patched GHSA-7rx3-28cr-v5wh in the @rootio/handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33941 CVE-2026-33941 in @rootio/handlebars - Patched by Root

Root has patched CVE-2026-33941 in the @rootio/handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-21668 CVE-2022-21668 in rootio-pipenv - Patched by Root

Root has patched CVE-2022-21668 in the rootio-pipenv package for Root:PyPI. Multiple fixed versions available...

PT-2026-53080

Root has patched GHSA-wjpw-4j6x-6rwh in the io.root.org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available...

n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

Impact When @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Whe...

n8n: Stored XSS in Chat Trigger Node

Impact An authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId. When a logged-in user visited the chat URL, the injected code executed in the n8n origin with that user's session privileges. Patches T...

CVE-2026-48779

Technical details for CVE-2026-48779 are not publicly available in the provided documents. Monitor for updates from the listed sources; the initial description includes affected versions and fixes, but no further technical specifics are provided here.

CVE-2026-48779

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to but not including 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally...

CVE-2026-48779 ws: Memory exhaustion DoS from tiny fragments and data chunks

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to but not including 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally...