168387 matches found
ROOT-APP-NPM-CVE-2026-54270 CVE-2026-54270 in @rootio/protobufjs - Patched by Root
Root has patched CVE-2026-54270 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...
SUSE CVE-2026-45796
Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...
SUSE CVE-2026-47190
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...
SUSE CVE-2026-47203
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. In versions 4.38.0 through 4.39.19, when a user authenticates via Basic Auth i.e via the Authorization header with the Basic scheme on t...
SUSE CVE-2026-47268
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhookurl, HTTP method, request...
SUSE CVE-2026-48089
DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user - including users from a different organization with no membership or role in the affected org/project - can create,...
SUSE CVE-2026-48777
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted...
SUSE CVE-2026-48794
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. In versions 4.36.0 through 4.39.19, due to lack of canonicalization of domains in very specific edge cases, an access control rule may b...
SUSE CVE-2026-49821
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying that Package.spec.environment.namespace matched...
SUSE CVE-2026-53521
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/id accepts and persists nonexistent ddnsprofiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those...
JLSEC-2026-1022 ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-24, when using an image with mask the Floyd-Steinberg dithering method it will cause a negative heap buffer over-write. This issue has been patched in version 7.1.2-24...
JLSEC-2026-953 ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access
ImageMagick is free and open-source software used for editing and manipulating digital images. The shipped "secure" security policy includes a rule intended to prevent reading/writing from standard streams. However, ImageMagick also supports fd: pseudo-filenames e.g., fd:0, fd:1. Prior to version...
JLSEC-2026-939 ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch...
CVE-2026-17543
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
ROOT-APP-NPM-CVE-2026-50015 CVE-2026-50015 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-50015 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-55699 CVE-2026-55699 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-55699 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-FR4H-3CPH-29XV GHSA-fr4h-3cph-29xv in @rootio/pnpm - Patched by Root
Root has patched GHSA-fr4h-3cph-29xv in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-55487 CVE-2026-55487 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-55487 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...