ROOT-OS-DEBIAN-12-CVE-2025-4948 CVE-2025-4948 in libsoup3 - Patched by Root

Root has patched CVE-2025-4948 in the libsoup3 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-15308 CVE-2026-15308 in python3.11 - Patched by Root

Root has patched CVE-2026-15308 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-7210 CVE-2026-7210 in python3.11 - Patched by Root

Root has patched CVE-2026-7210 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

BIT-TOMCAT-2026-55956 Apache Tomcat: Security constraints for default servlet ignored method

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0...

BIT-TOMCAT-2026-43515 Apache Tomcat: Security constraints not correctly applied

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu...

BIT-TOMCAT-2026-43514 Apache Tomcat: AJP secret compared in non-constant time

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may al...

BIT-TOMCAT-2026-25854 Apache Tomcat: Occasionally open redirect

Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.0 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported...

ROOT-APP-MAVEN-CVE-2025-49146 CVE-2025-49146 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2025-49146 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

EUVD-2026-75704

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

CVE-2026-88055 AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store metapagetitle or metapagefavicon through /api/admin/system-preferences, and MetaGenerator inserts those values into...

CVE-2026-88044

rclone versions 1.70.0 through 1.75.1 are affected by an authentication proxy bypass in the serve/start RC interface. The FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead of the per-server request-loc...

GO-2026-6386 SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy in github.com/siyuan-note/siyuan/kernel

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy in github.com/siyuan-note/siyuan/kernel...

ROOT-OS-ALPINE-318-CVE-2025-29087 CVE-2025-29087 in sqlite - Patched by Root

Root has patched CVE-2025-29087 in the sqlite package for Root:Alpine:3.18. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2026-28389 CVE-2026-28389 in openssl - Patched by Root

Root has patched CVE-2026-28389 in the openssl package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2025-69419 CVE-2025-69419 in openssl - Patched by Root

Root has patched CVE-2025-69419 in the openssl package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2025-69420 CVE-2025-69420 in openssl - Patched by Root

Root has patched CVE-2025-69420 in the openssl package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-OS-ALPINE-315-CVE-2026-28390 CVE-2026-28390 in openssl - Patched by Root

Root has patched CVE-2026-28390 in the openssl package for Root:Alpine:3.15. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-CMWH-PVXP-8882 GHSA-cmwh-pvxp-8882 in dompurify - Patched by Root

Root has patched GHSA-cmwh-pvxp-8882 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-OS-ALPINE-323-CVE-2026-16554 CVE-2026-16554 in cjson - Patched by Root

Root has patched CVE-2026-16554 in the cjson package for Root:Alpine:3.23. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-59892 CVE-2026-59892 in @opentelemetry/propagator-jaeger - Patched by Root

Root has patched CVE-2026-59892 in the @opentelemetry/propagator-jaeger package for Root:npm. Multiple fixed versions available...