CVE-2026-33437 Stirling PDF: Stored XSS in Info Summary

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

EUVD-2026-60319

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

CVE-2026-68520 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

CVE-2026-55704

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...

ROOT-APP-NPM-CVE-2021-3807 CVE-2021-3807 in ansi-regex - Patched by Root

Root has patched CVE-2021-3807 in the ansi-regex package for Root:npm. Multiple fixed versions available...

CVE-2026-74870

openssl_encrypt (pip) versions

ROOT-APP-PYPI-CVE-2026-42311 CVE-2026-42311 in pillow - Patched by Root

Root has patched CVE-2026-42311 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-25990 CVE-2026-25990 in pillow - Patched by Root

Root has patched CVE-2026-25990 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-40192 CVE-2026-40192 in pillow - Patched by Root

Root has patched CVE-2026-40192 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48735 CVE-2026-48735 in pypdf - Patched by Root

Root has patched CVE-2026-48735 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-59935 CVE-2026-59935 in pypdf - Patched by Root

Root has patched CVE-2026-59935 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-54530 CVE-2026-54530 in pypdf - Patched by Root

Root has patched CVE-2026-54530 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-49461 CVE-2026-49461 in pypdf - Patched by Root

Root has patched CVE-2026-49461 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-JM82-FX9C-MX94 GHSA-jm82-fx9c-mx94 in pypdf - Patched by Root

Root has patched GHSA-jm82-fx9c-mx94 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-59936 CVE-2026-59936 in pypdf - Patched by Root

Root has patched CVE-2026-59936 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27980 CVE-2026-27980 in next - Patched by Root

Root has patched CVE-2026-27980 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44577 CVE-2026-44577 in next - Patched by Root

Root has patched CVE-2026-44577 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27977 CVE-2026-27977 in next - Patched by Root

Root has patched CVE-2026-27977 in the next package for Root:npm. Multiple fixed versions available...