CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-69152

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-69149

CVE-2026-69149 affects Angular SSR: a Cross-Site Scripting (XSS) vulnerability in the DOM emulation dependency (domino) used by @angular/platform-server when serializing fallback raw-content elements (, , , ). The issue exists prior to versions 20.3.27, 21.2.19, and 22.0.7 and is fixed in those r...

K000162731: Linux kernel vulnerability CVE-2026-63793

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol-volumelabel with a mutex and snaphost the label before copytouser. This prevent a use-after-free when FSIOCSETFSLABEL replaces the vol-volumelabel an...

CVE-2026-68945

CVE-2026-68945 affects Angular’s HttpTransferCache in HttpClient. Before 20.3.27, 21.2.19, and 22.0.2, comma-joining repeated request parameters caused semantically distinct requests to share a transfer-cache key, leading to reuse of a wrong backend response and potential state poisoning. The iss...

CVE-2026-68930

Russh is a Rust SSH library. Prior to version 0.62.5, it dispatched channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request callback. This could allow callbacks to be reached w...

ROOT-APP-PYPI-CVE-2026-41479 CVE-2026-41479 in Authlib - Patched by Root

Root has patched CVE-2026-41479 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-28498 CVE-2026-28498 in Authlib - Patched by Root

Root has patched CVE-2026-28498 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41425 CVE-2026-41425 in Authlib - Patched by Root

Root has patched CVE-2026-41425 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27962 CVE-2026-27962 in Authlib - Patched by Root

Root has patched CVE-2026-27962 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-JJ8C-MMJ3-MMGV GHSA-jj8c-mmj3-mmgv in Authlib - Patched by Root

Root has patched GHSA-jj8c-mmj3-mmgv in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-45740 CVE-2026-45740 in protobufjs - Patched by Root

Root has patched CVE-2026-45740 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54269 CVE-2026-54269 in protobufjs - Patched by Root

Root has patched CVE-2026-54269 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44288 CVE-2026-44288 in protobufjs - Patched by Root

Root has patched CVE-2026-44288 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48817 CVE-2026-48817 in rootio-starlette - Patched by Root

Root has patched CVE-2026-48817 in the rootio-starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2020-36851 CVE-2020-36851 in @rootio/cors-anywhere - Patched by Root

Root has patched CVE-2020-36851 in the @rootio/cors-anywhere package for Root:npm. Multiple fixed versions available...

CVE-2026-18590

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...

ROOT-APP-MAVEN-CVE-2025-31650 CVE-2025-31650 in io.root.org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2025-31650 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...