ROOT-OS-UBUNTU-2404-CVE-2025-68172 CVE-2025-68172 in rootio-linux - Patched by Root

Root has patched CVE-2025-68172 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-43069 CVE-2026-43069 in rootio-linux - Patched by Root

Root has patched CVE-2026-43069 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-43194 CVE-2026-43194 in rootio-linux - Patched by Root

Root has patched CVE-2026-43194 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-53199 CVE-2026-53199 in rootio-linux - Patched by Root

Root has patched CVE-2026-53199 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-39677 CVE-2025-39677 in rootio-linux - Patched by Root

Root has patched CVE-2025-39677 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-23413 CVE-2026-23413 in rootio-linux - Patched by Root

Root has patched CVE-2026-23413 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

CVE-2026-16128

CVE-2026-16128 affects zevorn rt-claw up to 0.2.0, specifically the http_request path, claw/services/swarm/swarm.c and its receiver_thread function. A manipulation can trigger server-side request forgery and may be exploited remotely; exploit has been released publicly. Documents do not provide p...

CVE-2026-49977 tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by...

CVE-2026-8056

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the applytweaks function...

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...

CVE-2026-48009

Shopware vulnerability CVE-2026-48009: A low-privilege admin with user_recovery:read can takeover any admin by triggering password recovery, reading the recovery hash via Admin API, and resetting the password. Root cause: the hash field in UserRecoveryDefinition was exposed in the Admin API (no A...

CVE-2026-16103

Keycloak CVE-2026-16103 affects the keycloak-services component. It describes an incomplete fix for CVE-2026-9798: brute-force protection checks were added to the CIBA initiation path but omitted from the token redemption path. As a result, an attacker with valid client credentials can obtain acc...

CVE-2026-13082

CVE-2026-13082 affects GD::SecurityImage for Perl (versions through 1.75). The vulnerability arises because the CAPTCHA secret text is generated by sampling from a character set using Perl’s built-in rand, which is not suitable for security applications due to predictability and reversibility. Im...

ROOT-OS-DEBIAN-13-CVE-2026-27622 CVE-2026-27622 in rootio-openexr - Patched by Root

Root has patched CVE-2026-27622 in the rootio-openexr package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-43713

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

CVE-2026-52203

creationtimestamp| type| source ---|---|--- 2026-07-16 08:34:05+00:00| seen| https://gist.github.com/this1slwl/1bfb6996ca7edf6f5d15b5ebc181f337...

ROOT-APP-NPM-CVE-2026-49465 CVE-2026-49465 in @rootio/n8n - Patched by Root

Root has patched CVE-2026-49465 in the @rootio/n8n package for Root:npm. Multiple fixed versions available...

CVE-2026-15907 H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection

A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=logfwnbcmailjsondata. Executing a manipulation of the argument subject can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be...