ROOT-APP-NPM-CVE-2026-41239 CVE-2026-41239 in dompurify - Patched by Root

Root has patched CVE-2026-41239 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41240 CVE-2026-41240 in dompurify - Patched by Root

Root has patched CVE-2026-41240 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in dompurify - Patched by Root

Root has patched CVE-2026-49978 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-CJ63-JHHR-WCXV GHSA-cj63-jhhr-wcxv in dompurify - Patched by Root

Root has patched GHSA-cj63-jhhr-wcxv in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-R28C-9Q8G-F849 GHSA-r28c-9q8g-f849 in postcss - Patched by Root

Root has patched GHSA-r28c-9q8g-f849 in the postcss package for Root:npm. Multiple fixed versions available...

Dnsplit

Dnsplit - Sub-Domain Enumeration Tool 🕵️‍♂️ Dnsplit is a Python-based tool designed for efficiently discovering sub-domains. 🚀 It's a project that's close to my heart as I'm still relatively new to both coding and the ethical hacking field. Despite my beginner status, I've put in the effort to...

Lurkstrain

Lurkstrain An all in one admin panel crawler for pentesters...

ROOT-APP-PYPI-GHSA-6V7P-G79W-8964 GHSA-6v7p-g79w-8964 in msgpack - Patched by Root

Root has patched GHSA-6v7p-g79w-8964 in the msgpack package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54288 CVE-2026-54288 in hono - Patched by Root

Root has patched CVE-2026-54288 in the hono package for Root:npm. Multiple fixed versions available...

EUVD-2026-86530

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

Security Bulletin: IBM Verify Identity Governance Container affected by multiple vulnerabilities

Summary Multiple security vulnerabilities affecting dependent components used by IBM Verify Identity Governance Container have been addressed in the latest product update. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily...

sql-injection-labs

SQL Injection Labs — PortSwigger Web Security Academy A colle...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5515864418615296 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass

Ivanti Endpoint Manager Mobile EPMM, formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available. id: CVE-2023-35078 info...

Fortra GoAnywhere MFT - Remote Code Execution

Fortra GoAnywhere MFT is susceptible to remote code execution via unsafe deserialization of an arbitrary attacker-controlled object. This stems from a pre-authentication command injection vulnerability in the License Response Servlet. id: CVE-2023-0669 info: name: Fortra GoAnywhere MFT - Remote...

Dahua IPC/VTH/VTO - Authentication Bypass

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. id: CVE-2021-33045 info: name: Dahua IPC/VTH/VTO - Authentication Bypass author: phantomowl severity:...

CLEANSTART-2026-MS81723 NumberInput

Security vulnerability affects the apache-nifi package. NumberInput...

CLEANSTART-2026-MR78444 UTF8DataInputJsonParser

Security vulnerability affects the apache-nifi package. UTF8DataInputJsonParser...

CLEANSTART-2026-UB80318 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics 2.19.1-r3, kube-state-metrics 2.17.0-r6, kube-state-metrics 2.18.0-r9

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...