ROOT-OS-DEBIAN-13-CVE-2026-53106 CVE-2026-53106 in rootio-linux - Patched by Root

Root has patched CVE-2026-53106 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-3245

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution...

CVE-2026-51249

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

EUVD-2026-50443

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...

CVE-2026-65606

creationtimestamp| type| source ---|---|--- 2026-07-23 15:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd43i7i3i2a...

EUVD-2026-48096

Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...

CVE-2026-60712

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications...

CVE-2026-60584

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain component: CSV Management. The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation...

CVE-2026-60433

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain component: Integration. The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Transportation Managemen...

EUVD-2026-42311

protobufjs: Text Format string map parsing can mutate returned map object prototype...

EUVD-2025-203029

Tornado: Quadratic DoS via Crafted Multipart Parameters...

EUVD-2025-203031

Tornado: Quadratic DoS via Repeated Header Coalescing...

MINI-Q68M-RQXP-865F

Bulletin has no description...

CVE-2026-49855 tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an...

CVE-2026-49854

Summary: Tornado’s optional native extension tornado.speedups mishandles the websocket_mask length, reading beyond a four-byte buffer when invoked through the XSRF token decoder with the extension active. This out-of-bounds access affects Tornado up to version 6.5.5 and is fixed in 6.5.6. Impact:...

CVE-2026-49853

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme, host, or port...

CVE-2026-6541

creationtimestamp| type| source ---|---|--- 2026-07-13 13:19:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjrrssiwv27 2026-07-13 13:34:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjsnlua352g 2026-07-13 18:19:01+00:00| seen|...

CVE-2026-59877

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends...

CVE-2026-59876 protobufjs: Text Format string map parsing can mutate returned map object prototype

protobufjs compiles protobuf definitions into JavaScript JS functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned map object instead of...

PT-2026-56497

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6 Description protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reach...