ROOT-APP-MAVEN-CVE-2026-22745 CVE-2026-22745 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-22745 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41845 CVE-2026-41845 in org.springframework:spring-core - Patched by Root

Root has patched CVE-2026-41845 in the org.springframework:spring-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22735 CVE-2026-22735 in org.springframework:spring-webflux - Patched by Root

Root has patched CVE-2026-22735 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22741 CVE-2026-22741 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-22741 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-56PW-MPJ4-FXWW GHSA-56pw-mpj4-fxww in pillow - Patched by Root

Root has patched GHSA-56pw-mpj4-fxww in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-67030 CVE-2025-67030 in org.codehaus.plexus:plexus-utils - Patched by Root

Root has patched CVE-2025-67030 in the org.codehaus.plexus:plexus-utils package for Root:Maven. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44494 CVE-2026-44494 in axios - Patched by Root

Root has patched CVE-2026-44494 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-42033 CVE-2026-42033 in axios - Patched by Root

Root has patched CVE-2026-42033 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-62718 CVE-2025-62718 in axios - Patched by Root

Root has patched CVE-2025-62718 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-42035 CVE-2026-42035 in axios - Patched by Root

Root has patched CVE-2026-42035 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-25639 CVE-2026-25639 in axios - Patched by Root

Root has patched CVE-2026-25639 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44495 CVE-2026-44495 in axios - Patched by Root

Root has patched CVE-2026-44495 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44488 CVE-2026-44488 in axios - Patched by Root

Root has patched CVE-2026-44488 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44486 CVE-2026-44486 in axios - Patched by Root

Root has patched CVE-2026-44486 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-42264 CVE-2026-42264 in axios - Patched by Root

Root has patched CVE-2026-42264 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-40175 CVE-2026-40175 in axios - Patched by Root

Root has patched CVE-2026-40175 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44487 CVE-2026-44487 in axios - Patched by Root

Root has patched CVE-2026-44487 in the axios package for Root:npm. Multiple fixed versions available...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the execglobals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication. id: CVE-2026-0770 info: name: Langflow...

TerraMaster TOS <.1.29 - Remote Code Execution

TerraMaster TOS before 4.1.29 has invalid parameter checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with for example OS commands in the opt parameter. id:...