CVE-2026-76845

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

UBUNTU-CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

UBUNTU-CVE-2026-78376

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption...

MINI-3446-Q988-7H93

Bulletin has no description...

MINI-QM29-7GRQ-QXR7

Bulletin has no description...

MINI-M569-QHJ6-8V6R

Bulletin has no description...

MINI-RWGR-92GH-22HF

Bulletin has no description...

MINI-4RCP-VW9F-GH9H

Bulletin has no description...

MAL-2026-14410 Malicious code in @temptation.js/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ac41747a5c926627c28c9f1a651df91cd3447b07ca4cafabc1916004d1e70 The package registers a preinstall hook node index.js that runs on npm install and harvests installer-side data: os.hostname, OS username, home...

ROOT-APP-MAVEN-CVE-2026-0636 CVE-2026-0636 in org.bouncycastle:bcprov-jdk18on - Patched by Root

Root has patched CVE-2026-0636 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-59639 CVE-2026-59639 in org.bouncycastle:bcpkix-jdk18on - Patched by Root

Root has patched CVE-2026-59639 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available...

CVE-2026-76845 adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

MAL-2026-14404 Malicious code in @blurrydespair/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8 Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require o...

ROOT-APP-MAVEN-CVE-2019-14439 CVE-2019-14439 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2019-14439 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-36184 CVE-2020-36184 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-36184 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2019-12086 CVE-2019-12086 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2019-12086 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-35491 CVE-2020-35491 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-35491 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2018-7489 CVE-2018-7489 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2018-7489 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-35490 CVE-2020-35490 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-35490 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-35728 CVE-2020-35728 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-35728 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...