ROOT-APP-NPM-CVE-2026-77078 CVE-2026-77078 in multer - Patched by Root

Root has patched CVE-2026-77078 in the multer package for Root:npm. Multiple fixed versions available...

CVE-2026-86610

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

ROOT-APP-NPM-CVE-2026-2391 CVE-2026-2391 in qs - Patched by Root

Root has patched CVE-2026-2391 in the qs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-24999 CVE-2022-24999 in qs - Patched by Root

Root has patched CVE-2022-24999 in the qs package for Root:npm. Multiple fixed versions available...

EUVD-2026-90511

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-86610

The Download Manager WordPress plugin (versions before 3.3.71 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient sanitization and escaping of a package setting before it is rendered on a page; specifically, the sanitization logic fails to neutralize single quote...

ROOT-APP-MAVEN-CVE-2026-48043 CVE-2026-48043 in io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-48043 in the io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39833 CVE-2026-39833 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39833 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39831 CVE-2026-39831 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39831 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39827 CVE-2026-39827 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39827 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

[SECURITY] Fedora 44 Update: uv-0.12.19-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784024382)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784024382 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute...

Rocky Linux 8 [CIQ] Security Update: osbuild / osbuild-composer / osbuild-composer-core / etc (crlsa-2024_2961)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242961 advisory. osbuild-composer: race condition may disable GPG verification for package repositories CVE-2024-2307 Tenable has extracted the preceding description block directly...

Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1784216354)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784216354 advisory. - The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII- only label. For example,...

Rocky Linux 10.2 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_19141)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619141 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_11635)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202611635 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784024382)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784024382 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execu...

Rocky Linux 9 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_19354)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619354 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...