CVE-2026-8709 Privilege escalation in Progress MarkLogic Server REST document patch operation

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...

EUVD-2026-53425

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...

GHSA-JX35-X7FJ-VGPR Ghost Content API filter bypass reveals private fields

Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes'...

Ghost Content API filter bypass reveals private fields

Impact The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes'...

Ghost: Cross-Site Scripting in Feature Image Captions

Impact An input validation issue allowed any staff user to create a post with content that could be used to hijack another staff user's Ghost Admin session resulting in privilege escalation. Vulnerable versions This vulnerability is present in Ghost from v4.9.0 up to v6.54.0. Patches v6.54.1...

Malicious code in claims-patch-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....

MAL-2026-12631 Malicious code in claims-patch-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....

ROOT-APP-NPM-NSWG-ECO-434 NSWG-ECO-434 in base64-url - Patched by Root

Root has patched NSWG-ECO-434 in the base64-url package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-MH5C-679W-HH4R GHSA-mh5c-679w-hh4r in mongodb - Patched by Root

Root has patched GHSA-mh5c-679w-hh4r in the mongodb package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-57810 CVE-2025-57810 in jspdf - Patched by Root

Root has patched CVE-2025-57810 in the jspdf package for Root:npm. Multiple fixed versions available...

Astra Linux – vulnerability in Firefox

Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption; we assume that with sufficient effort, some of them could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 150.0.1 and Thunderbird 150.0.1...

CVE-2026-55953 affecting package erlang for versions less than 26.2.5.21-3

CVE-2026-55953 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...

ROOT-APP-NPM-AIKIDO-2026-10469 AIKIDO-2026-10469 in knex - Patched by Root

Root has patched AIKIDO-2026-10469 in the knex package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41182 CVE-2026-41182 in langsmith - Patched by Root

Root has patched CVE-2026-41182 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-RR7J-V2Q5-CHGV GHSA-rr7j-v2q5-chgv in langsmith - Patched by Root

Root has patched GHSA-rr7j-v2q5-chgv in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-F4XH-W4CJ-QXQ8 GHSA-f4xh-w4cj-qxq8 in langsmith - Patched by Root

Root has patched GHSA-f4xh-w4cj-qxq8 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-33230 CVE-2026-33230 in nltk - Patched by Root

Root has patched CVE-2026-33230 in the nltk package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1785917668 TuxCare security update for org.apache.tomcat (3 CVEs)

TuxCare rebuilt 2 org.apache.tomcat packages to address 3 CVEs. Fixed in 7.0.109-tuxcare.4...

CVE-2026-64575 bpf: tcp: fix double sock release on batch realloc

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

CVE-2026-64566

Consolidated details show CVE-2026-64566 affects the Linux kernel iptfs module. Root cause: when iptfs_skb_add_frags() copies frag references, it increments page refs without propagating SKBFL_SHARED_FRAG to the destination SKB, unlike other frag-transfer helpers. Consequence: if source SKB has s...