ROOT-APP-NPM-CVE-2026-4926 CVE-2026-4926 in path-to-regexp - Patched by Root

Root has patched CVE-2026-4926 in the path-to-regexp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44574 CVE-2026-44574 in next - Patched by Root

Root has patched CVE-2026-44574 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44573 CVE-2026-44573 in next - Patched by Root

Root has patched CVE-2026-44573 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-Q4GF-8MX6-V5V3 GHSA-q4gf-8mx6-v5v3 in next - Patched by Root

Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-8H8Q-6873-Q5FJ GHSA-8h8q-6873-q5fj in next - Patched by Root

Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available...

MINI-QF9J-H7HX-MGMX

Bulletin has no description...

MINI-G486-W8JV-948H

Bulletin has no description...

MINI-98C9-X78R-3CXX

Bulletin has no description...

MINI-P5Q2-7HJR-H573

Bulletin has no description...

MINI-C399-R3F3-8WJ6

Bulletin has no description...

MINI-C2WQ-PRPR-3HF6

Bulletin has no description...

CVE-2026-19930

A security flaw has been discovered in Dolibarr up to 23.0.3. Affected is an unknown function of the file htdocs/user/card.php of the component User Cloning. The manipulation of the argument ID results in ldap injection. It is possible to launch the attack remotely. The exploit has been released ...

Oracle WebLogic Server - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS - Web Services is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions...

Commvault CommCell - Local File Inclusion

CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder. id: CVE-2020-25780 info: name: Commvault...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10546 info: name:...

Ruby On Rails - Local File Inclusion

Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. id: CVE-2018-3760 info: name: Ruby On Rails - Local File Inclusio...

Atlassian Jira Confluence - Cross-Site Scripting

Atlassian Jira Confluence before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4, and from version 7.9.0 before version 7.9.2, allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the error messa...

HPE System Management - Cross-Site Scripting

HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Eaton Intelligent Power Manager 1.6 - Directory Traversal

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. id: CVE-2018-12031 info: name: Eaton Intelligent Power Manager 1.6 - Directory Traversal author: daffainfo...

Masa CMS - Authentication Bypass

Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...