exploit-foxit-4.1.1-title-bof

This repository does not have a README...

CLEANSTART-2026-DG62479 Security fixes in cassandra-reaper-fips 4.1.1-r3

Package cassandra-reaper-fips version 4.1.1-r3 fixes 4 vulnerabilities: CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-10050...

CLEANSTART-2026-YI37990 Security fixes in kafka 4.1.1-r0

Package kafka version 4.1.1-r0 fixes 1 vulnerabilities: ghsa-vc5p-v9hr-52mj...

CLEANSTART-2026-IX44091 Security fixes in py3-langgraph-checkpoint 4.1.1-r0

Package py3-langgraph-checkpoint version 4.1.1-r0 fixes 1 vulnerabilities: ghsa-f4xh-w4cj-qxq8...

fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact fast-uri v4.1.0 and earlier do not treat a literal backslash U+005C as an authority delimiter. Node's native WHATWG URL used by fetch, undici, and Node's http/https clients normalizes \ to / for special schemes http, https, ws, wss, ftp, file, so the two parsers extract different hosts fro...

SUSE CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CLEANSTART-2026-VB75499 Security fixes for ghsa-f4xh-w4cj-qxq8 applied in versions: 4.1.1-r0

Security vulnerability affects the py3-langgraph-checkpoint package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-63071

An Improper Isolation or Compartmentalization vulnerability exists in Apache Syncope (specifically the GroovySandboxScriptEngineImpl in the core/spring module). An administrator with sufficient entitlements to manage Implementations can create a malicious Groovy class that bypasses the Groovy sec...

CVE-2026-48815 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications...

CVE-2026-48815

Summary of CVE-2026-48815 : In sigstore-js, the documented certificateOIDs option in sigstore.verify() is accepted by the public API before verification but discarded during verification, causing certificate extension OIDs to not be checked. This allows applications to accept unauthorized certifi...

CVE-2026-55590

The CVE-2026-55590 entry concerns the CakePHP Authentication plugin (CakePHP, PSR-7 compatible) with a backslash bypass in getLoginRedirect() that enables open redirects to attacker-controlled hostnames through the redirect query parameter. Affected versions: prior to 2.11.1, 3.3.6, and 4.1.1. Th...

PYSEC-2026-2834 NULL Pointer Dereference in OpenCV.

An issue was discovered in OpenCV before 4.1.1 OpenCV-Python before 4.1.1.26. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp...

Apache HDFS Provider error message suggested

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentationinfo pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The...

GHSA-HHPQ-7WG4-36JM CakePHP Authentication: Open redirect weakness via backslash bypass

Impact The getLoginRedirect method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames. Patches 2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue. Workarounds If you are unable to upgrade, you should consider adding application validation to t...

CVE-2026-48775 LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB both sync and async, via aiosqlite. In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify...

CVE-2026-48775

LangGraph SQLite Checkpoint (JsonPlusSerializer) is vulnerable in 4.1.0 and earlier due to unsafe deserialization of JSON checkpoint payloads. If an unauthorized party can modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the appl...

PT-2026-49755

Name of the Vulnerable Software and Affected Versions LangGraph SQLite Checkpoint versions prior to 4.1.1 Description The JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. If an unauthorized party modifies checkpoint bytes at rest in the backing store, the...

MAL-2026-5297 Malicious code in consumerweb-authflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acbd81f78a40f87b410799545f06c929bc7e7c3f552eeea06254416b3b9e0977 On npm install, the package's postinstall.js collects host identifiers via os.hostname, os.userInfo.username, os.platform, and the current working...

UBUNTU-CVE-2026-38978

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths...

CVE-2026-49009

Northern.tech Mender Server versions v4.1.0 and v4.0.1 and below are vulnerable to an authenticated path traversal vulnerability within the single-file artifact generation API endpoint (/api/management/v1/deployments/artifacts/generate). An attacker with a valid account can supply ../ sequences i...