ROOT-APP-MAVEN-CVE-2026-59639 CVE-2026-59639 in org.bouncycastle:bcpkix-jdk18on - Patched by Root

Root has patched CVE-2026-59639 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2025-47911 CVE-2025-47911 in golang.org/x/net - Patched by Root

Root has patched CVE-2025-47911 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2025-58190 CVE-2025-58190 in golang.org/x/net - Patched by Root

Root has patched CVE-2025-58190 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-40094 CVE-2024-40094 in com.graphql-java:graphql-java - Patched by Root

Root has patched CVE-2024-40094 in the com.graphql-java:graphql-java package for Root:Maven. Multiple fixed versions available...

Adobe ColdFusion - Unrestricted File Upload Remote Code Execution

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution. id: CVE-2018-15961 info: name: Adobe ColdFusion - Unrestricted File Upload...

PT-2026-97923

Name of the Vulnerable Software and Affected Versions Termix versions 2.4.1 through 2.5.0 Description An authenticated administrator can execute arbitrary operating-system commands as the backend process. This occurs because the application fails to properly sanitize domain and email values store...

Linux Distros Unpatched Vulnerability : CVE-2026-93825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using...

Linux Distros Unpatched Vulnerability : CVE-2026-93261

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - locking/lockdep: Fix NULL pointer dereference in locksetclass registerlockclass can return NULL when the lock class pool is exhausted, graphlock fails, or key...

CVE-2026-93352

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...

automation-controller: automation-controller-container: automation-controller: workflow job template node execute permission check bypassed by creating a node with a null unified_job_template and then patching it, allowing a single workflow-admin to execute any other tenant's job template with the victim's credentials (cross-tenant privilege escalation)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the...

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...

GHSA-VMJQ-HVGQ-2WV4 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...

CVE-2026-86319

A flaw was found in java-json-tools json-patch. A remote attacker can exploit a vulnerability in the JsonPatch.apply function within the Patch Operation Handler component. By manipulating input, an attacker can cause excessive resource consumption, leading to a Denial of Service DoS condition...

CVE-2026-86512

A flaw was found in java-json-tools json-patch. This vulnerability, located in the CopyOperation.apply and MoveOperation.apply functions, allows for improper access controls. A remote attacker could exploit this to potentially perform unauthorized operations, leading to impacts on confidentiality...

SUSE-SU-2026:4315-1 Security update for the Linux Kernel (Live Patch 41 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.169 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on...

CVE-2026-61834

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

CVE-2026-61834

The scim-patch library, used for applying SCIM patch operations, is vulnerable to process-global mutation in versions prior to 0.9.2 . The root cause lies in the navigate() function reading inherited properties and the assign() function using prototype-chain membership checks when resolving attac...

CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...