CVE-2026-110623 Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

EUVD-2026-101251

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

ROOT-APP-NUGET-CVE-2026-40894 CVE-2026-40894 in OpenTelemetry.Api - Patched by Root

Root has patched CVE-2026-40894 in the OpenTelemetry.Api package for Root:NuGet. Multiple fixed versions available...

TruConfidence: Why Your Patch Automation Can Finally Be Autonomous

TruConfidence: The AI-Powered Remediation Intelligence & Orchestration engine powering TruRisk Eliminate 2.0 delivers autonomous remediation at scale with proof at every step. Executive Summary Vulnerabilities are now discovered faster than enterprises can remediate them. Patch automation has bee...

ROOT-APP-NPM-CVE-2026-33891 CVE-2026-33891 in node-forge - Patched by Root

Root has patched CVE-2026-33891 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-25881 CVE-2022-25881 in http-cache-semantics - Patched by Root

Root has patched CVE-2022-25881 in the http-cache-semantics package for Root:npm. Multiple fixed versions available...

Microsoft Fixes 1,413 Vulnerabilities in Record October Patch Tuesday Update

Microsoft addressed 1,413 security vulnerabilities in its October 2026 Patch Tuesday update, making it the company’s largest monthly…...

ROOT-APP-NPM-CVE-2025-12816 CVE-2025-12816 in node-forge - Patched by Root

Root has patched CVE-2025-12816 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-66030 CVE-2025-66030 in node-forge - Patched by Root

Root has patched CVE-2025-66030 in the node-forge package for Root:npm. Multiple fixed versions available...

flatpak-builder security update

An update is available for flatpak-builder. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Flatpak-builder is a tool for building flatpaks from sources. Securit...

RLSA-2026:80973 Important: flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git-am CVE-2026-86320 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

CVE-2026-110623: Missing Authorization

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/nodeid to grant themselves an...

Rocky Linux 10.2 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2026_80495)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680495 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2026_80496)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680496 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding descriptio...

AlmaLinux 9 : flatpak-builder (ALSA-2026:80496)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:80496 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding descripti...

AlmaLinux 10 : flatpak-builder (ALSA-2026:80495)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:80495 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding...

RockyLinux 8 : flatpak-builder (RLSA-2026:80973)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:80973 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding...

CVE-2026-110216

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...