ROOT-OS-DEBIAN-13-CVE-2026-49346 CVE-2026-49346 in libde265 - Patched by Root

Root has patched CVE-2026-49346 in the libde265 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-42250 CVE-2026-42250 in bzip2 - Patched by Root

Root has patched CVE-2026-42250 in the bzip2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-58050 CVE-2026-58050 in libssh2 - Patched by Root

Root has patched CVE-2026-58050 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-66032 CVE-2026-66032 in libssh2 - Patched by Root

Root has patched CVE-2026-66032 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-58051 CVE-2026-58051 in libssh2 - Patched by Root

Root has patched CVE-2026-58051 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-55200 CVE-2026-55200 in libssh2 - Patched by Root

Root has patched CVE-2026-55200 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-66035 CVE-2026-66035 in libssh2 - Patched by Root

Root has patched CVE-2026-66035 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-15661 CVE-2025-15661 in libssh2 - Patched by Root

Root has patched CVE-2025-15661 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-7598 CVE-2026-7598 in libssh2 - Patched by Root

Root has patched CVE-2026-7598 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-66034 CVE-2026-66034 in libssh2 - Patched by Root

Root has patched CVE-2026-66034 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-66033 CVE-2026-66033 in libssh2 - Patched by Root

Root has patched CVE-2026-66033 in the libssh2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-50422 CVE-2025-50422 in cairo - Patched by Root

Root has patched CVE-2025-50422 in the cairo package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-32327 CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34502 CVE-2026-34502 in apr-util - Patched by Root

Root has patched CVE-2026-34502 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34191 CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-49506 CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34501 CVE-2026-34501 in apr-util - Patched by Root

Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-54370 CVE-2026-54370 in acl - Patched by Root

Root has patched CVE-2026-54370 in the acl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-54369 CVE-2026-54369 in acl - Patched by Root

Root has patched CVE-2026-54369 in the acl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2022-48623 CVE-2022-48623 in libcpanel-json-xs-perl - Patched by Root

Root has patched CVE-2022-48623 in the libcpanel-json-xs-perl package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2025-40908 CVE-2025-40908 in libyaml-libyaml-perl - Patched by Root

Root has patched CVE-2025-40908 in the libyaml-libyaml-perl package for Root:Debian:11. Multiple fixed versions available...

CLSA-2026-1787142559 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post3+tuxcare...

CGA-QJG5-83W4-3P7W

Bulletin has no description...

ROOT-APP-PYPI-CVE-2023-39631 CVE-2023-39631 in numexpr - Patched by Root

Root has patched CVE-2023-39631 in the numexpr package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-23897 CVE-2026-23897 in @apollo/server - Patched by Root

Root has patched CVE-2026-23897 in the @apollo/server package for Root:npm. Multiple fixed versions available...

ROOT-OS-UBUNTU-2004-CVE-2025-48384 CVE-2025-48384 in git - Patched by Root

Root has patched CVE-2025-48384 in the git package for Root:Ubuntu:20.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2004-CVE-2026-41651 CVE-2026-41651 in packagekit - Patched by Root

Root has patched CVE-2026-41651 in the packagekit package for Root:Ubuntu:20.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2004-CVE-2025-68973 CVE-2025-68973 in gnupg2 - Patched by Root

Root has patched CVE-2025-68973 in the gnupg2 package for Root:Ubuntu:20.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2004-CVE-2026-45447 CVE-2026-45447 in openssl - Patched by Root

Root has patched CVE-2026-45447 in the openssl package for Root:Ubuntu:20.04. Multiple fixed versions available...

CLSA-2026-1787141079 TuxCare security update for log4j:log4j (1 CVE)

TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.16-tuxcare.2...

USN-8563-3 nginx vulnerability

USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was backed out in USN-8563-2 because it could cause a regression. This update includes a better fix for CVE-2026-42533. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly...

ROOT-OS-UBUNTU-2004-CVE-2025-32462 CVE-2025-32462 in sudo - Patched by Root

Root has patched CVE-2025-32462 in the sudo package for Root:Ubuntu:20.04. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-59996 CVE-2026-59996 in openssh - Patched by Root

Root has patched CVE-2026-59996 in the openssh package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-59995 CVE-2026-59995 in openssh - Patched by Root

Root has patched CVE-2026-59995 in the openssh package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-60002 CVE-2026-60002 in openssh - Patched by Root

Root has patched CVE-2026-60002 in the openssh package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-59997 CVE-2026-59997 in openssh - Patched by Root

Root has patched CVE-2026-59997 in the openssh package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-60001 CVE-2026-60001 in openssh - Patched by Root

Root has patched CVE-2026-60001 in the openssh package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-60000 CVE-2026-60000 in openssh - Patched by Root

Root has patched CVE-2026-60000 in the openssh package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-59998 CVE-2026-59998 in openssh - Patched by Root

Root has patched CVE-2026-59998 in the openssh package for Root:Debian:13. Multiple fixed versions available...

CLSA-2026-1787140595 TuxCare security update for orjson (2 CVEs)

TuxCare rebuilt orjson to address 2 CVEs. Fixed in 3.8.5.post2+tuxcare...

PYSEC-2026-3678 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

PYSEC-2026-3677 Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Summary Repo under test: https://github.com/Netflix/lemur When ADMINONLYAUTHORITYCREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent field...

PYSEC-2026-3680 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

PYSEC-2026-3682 linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

Summary Every Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...

PYSEC-2026-3676 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...

PYSEC-2026-3673 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

PYSEC-2026-3679 Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Summary The fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

PYSEC-2026-3675 Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Summary Repo under test: https://github.com/Netflix/lemur The certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...

PYSEC-2026-3674 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Summary Lemur's destination read endpoints -- GET /api/1/destinations and GET /api/1/destinations/ -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints POST/PUT/DELETE a...

PYSEC-2026-3661 devpi-server may leak database contents

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...