ROOT-APP-NPM-CVE-2022-46175 CVE-2022-46175 in json5 - Patched by Root

Root has patched CVE-2022-46175 in the json5 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-38704 CVE-2023-38704 in import-in-the-middle - Patched by Root

Root has patched CVE-2023-38704 in the import-in-the-middle package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33228 CVE-2026-33228 in flatted - Patched by Root

Root has patched CVE-2026-33228 in the flatted package for Root:npm. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-50613 CVE-2024-50613 in libsndfile - Patched by Root

Root has patched CVE-2024-50613 in the libsndfile package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-49295 CVE-2026-49295 in libde265 - Patched by Root

Root has patched CVE-2026-49295 in the libde265 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2024-38950 CVE-2024-38950 in libde265 - Patched by Root

Root has patched CVE-2024-38950 in the libde265 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-49337 CVE-2026-49337 in libde265 - Patched by Root

Root has patched CVE-2026-49337 in the libde265 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-11940 CVE-2026-11940 in python3.13 - Patched by Root

Root has patched CVE-2026-11940 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-11972 CVE-2026-11972 in python3.13 - Patched by Root

Root has patched CVE-2026-11972 in the python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-32913 CVE-2025-32913 in libsoup3 - Patched by Root

Root has patched CVE-2025-32913 in the libsoup3 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-4948 CVE-2025-4948 in libsoup3 - Patched by Root

Root has patched CVE-2025-4948 in the libsoup3 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-15308 CVE-2026-15308 in python3.11 - Patched by Root

Root has patched CVE-2026-15308 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

BIT-TOMCAT-2026-55956 Apache Tomcat: Security constraints for default servlet ignored method

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0...

BIT-TOMCAT-2026-43515 Apache Tomcat: Security constraints not correctly applied

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu...

BIT-TOMCAT-2026-43514 Apache Tomcat: AJP secret compared in non-constant time

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may al...

BIT-TOMCAT-2026-25854 Apache Tomcat: Occasionally open redirect

Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.0 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported...

ROOT-APP-MAVEN-CVE-2025-49146 CVE-2025-49146 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2025-49146 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

EUVD-2026-75704

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

CVE-2026-88055 AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store metapagetitle or metapagefavicon through /api/admin/system-preferences, and MetaGenerator inserts those values into...

CVE-2026-88044

rclone versions 1.70.0 through 1.75.1 are affected by an authentication proxy bypass in the serve/start RC interface. The FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead of the per-server request-loc...