EUVD-2024-55724

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack m...

ROOT-APP-GOBINARY-CVE-2026-39833 CVE-2026-39833 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39833 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39831 CVE-2026-39831 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39831 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2025-47913 CVE-2025-47913 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2025-47913 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-46597 CVE-2026-46597 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-46597 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-39835 CVE-2026-39835 in golang.org/x/crypto - Patched by Root

Root has patched CVE-2026-39835 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-H25M-26QC-WCJF GHSA-h25m-26qc-wcjf in next - Patched by Root

Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available...

CVE-2026-75090

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

EUVD-2026-60541

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

CVE-2026-9859

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

CVE-2026-9859

Mattermost Boards plugin (versions ≤11.7.6, ≤10.11.21, ≤11.8.3) fails to enforce PermissionManageBoardRoles on the batch endpoint's channelId field, allowing authenticated board editors to relink boards to arbitrary channels via crafted PATCH requests. CVSS 3.1 scores 6.5 (MEDIUM) for network-bas...

EUVD-2026-60442

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set and apos.util.get, allowing an authenticated editor to overwrite the shared...

CVE-2026-71553 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set and apos.util.get, allowing an authenticated editor to overwrite the shared...

CVE-2026-8723

A flaw was found in the qs library. When the qs.stringify function processes arrays containing null or undefined elements, and is configured with both arrayFormat: 'comma' and encodeValuesOnly: true, it can trigger a TypeError. This error causes the application to crash or return a 500 error,...

CVE-2025-27770

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...

ROOT-APP-NPM-CVE-2026-18446 CVE-2026-18446 in fast-uri - Patched by Root

Root has patched CVE-2026-18446 in the fast-uri package for Root:npm. Multiple fixed versions available...

CVE-2025-27772 Uptrain vulnerable to remote code execution via `/new_run` endpoint

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

EUVD-2025-210736

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /newrun endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able ...

CVE-2025-27771

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27770 UpTrain vulnerable to Remote code execution at `/create_project`

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /createproject endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may b...