JLSEC-2026-939 ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch...

CLEANSTART-2026-BM38174 Security fixes in istio 1.28.5-r2

Package istio version 1.28.5-r2 fixes 2 vulnerabilities: CVE-2025-15558, ghsa-p436-gjf2-799p...

ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in @rootio/axios - Patched by Root

Root has patched CVE-2026-44489 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

CVE-2026-48060 Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

EUVD-2026-49991

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

ROOT-APP-NPM-CVE-2026-41240 CVE-2026-41240 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-41240 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-53550 CVE-2026-53550 in @rootio/js-yaml - Patched by Root

Root has patched CVE-2026-53550 in the @rootio/js-yaml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-69873 CVE-2025-69873 in @rootio/ajv - Patched by Root

Root has patched CVE-2025-69873 in the @rootio/ajv package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-56761 CVE-2026-56761 in @rootio/hono - Patched by Root

Root has patched CVE-2026-56761 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-3304 CVE-2026-3304 in @rootio/multer - Patched by Root

Root has patched CVE-2026-3304 in the @rootio/multer package for Root:npm. Multiple fixed versions available...

EUVD-2026-49049

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component addmcpserver. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been...

CVE-2026-64419

The CVE-2026-64419 entry concerns the Linux kernel mm/shrinker path, where shrinker_debugfs_count_show() invokes the ->count_objects() callback while holding rcu_read_lock, allowing a sleep in that context. The root cause is that the debugfs count probe for memcg-aware shrinkers slept inside a...

SUSE CVE-2026-64231

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

ROOT-OS-DEBIAN-13-CVE-2023-39327 CVE-2023-39327 in rootio-openjpeg2 - Patched by Root

Root has patched CVE-2023-39327 in the rootio-openjpeg2 package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-47708

CVE-2026-47708 (MCP-for-Stata) : Multiple sources describe a command-injection vulnerability in the log_file_name parameter used by the stata_do/stata-mcp wrapper. Prior to version 1.17.3, log_file_name is interpolated into a Stata command string without sanitization; the GuardValidator does not ...

ROOT-OS-DEBIAN-13-CVE-2026-32739 CVE-2026-32739 in rootio-libheif - Patched by Root

Root has patched CVE-2026-32739 in the rootio-libheif package for Root:Debian:13. Multiple fixed versions available...

hplip security update

An update is available for hplip. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The hplip packages contain the Hewlett-Packard Linux Imaging and Printing...

ROOT-APP-NPM-CVE-2025-1647 CVE-2025-1647 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42583 CVE-2026-42583 in io.root.io.netty:netty-codec - Patched by Root

Root has patched CVE-2026-42583 in the io.root.io.netty:netty-codec package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42587 CVE-2026-42587 in io.root.io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-42587 in the io.root.io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...