ROOT-OS-DEBIAN-13-CVE-2026-24882 CVE-2026-24882 in gnupg2 - Patched by Root

Root has patched CVE-2026-24882 in the gnupg2 package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-101035 aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception

A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component nr-gnb. Executing a manipulation can lead to uncaught exception. The attack can be launched remotely. The exploit has been published and ma...

AZL-104963 CVE-2026-94283 affecting package libX11 1.8.7-1

An out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

AZL-104966 CVE-2026-94282 affecting package libXi 1.8.1-1

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client...

DEBIAN-CVE-2026-94284

An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

AZL-104957 CVE-2026-94285 affecting package libX11 1.8.7-1

An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

AZL-104969 CVE-2026-94286 affecting package libXtst 1.2.4-1

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...

DEBIAN-CVE-2026-94285

An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

DEBIAN-CVE-2026-94283

An out-of-bounds read vulnerability in libX11's XIM X Input Method attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

DEBIAN-CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

AZL-104960 CVE-2026-94284 affecting package libX11 1.8.7-1

An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

DEBIAN-CVE-2026-94286

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients...

DEBIAN-CVE-2026-94282

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client...

DEBIAN-CVE-2026-101017

A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarcpolicy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been ma...

DEBIAN-CVE-2026-101016

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarcpolicyparsedmarc in the library libopendmarc/opendmarcpolicy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remot...

DEBIAN-CVE-2026-101015

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched...

DEBIAN-CVE-2026-101014

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcutilcleanup in the library libopendmarc/opendmarcutil.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be...

ROOT-APP-NPM-GHSA-3F6P-5WW8-9RCR GHSA-3f6p-5ww8-9rcr in mysql2 - Patched by Root

Root has patched GHSA-3f6p-5ww8-9rcr in the mysql2 package for Root:npm. Multiple fixed versions available...

CGA-V475-23MQ-R97J

Bulletin has no description...

CGA-V43P-V3VP-QV5M

Bulletin has no description...

CVE-2026-94287 Denial of service via unsigned underflow in libXpm's write path

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

ROOT-APP-GOBINARY-CVE-2026-42154 CVE-2026-42154 in github.com/prometheus/prometheus - Patched by Root

Root has patched CVE-2026-42154 in the github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-42151 CVE-2026-42151 in github.com/prometheus/prometheus - Patched by Root

Root has patched CVE-2026-42151 in the github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available...

SUSE-SU-2026:4355-1 Security update for nodejs16

This update for nodejs16 fixes the following issues: - CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. - CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. - CVE-2025-23167:...

DEBIAN-CVE-2026-62439

Bulletin has no description...

DEBIAN-CVE-2026-88841

Bulletin has no description...

DEBIAN-CVE-2026-96544

Bulletin has no description...

DEBIAN-CVE-2026-96543

Bulletin has no description...

DEBIAN-CVE-2026-95622

Bulletin has no description...

BIT-MONGODB-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

BIT-MONGODB-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...

ROOT-APP-MAVEN-CVE-2026-41732 CVE-2026-41732 in org.springframework.pulsar:spring-pulsar - Patched by Root

Root has patched CVE-2026-41732 in the org.springframework.pulsar:spring-pulsar package for Root:Maven. Multiple fixed versions available...

CVE-2026-86507 Apache Roller: Stored XSS in comment moderation via comment author URL

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comment...

ROOT-APP-GOBINARY-CVE-2026-85731 CVE-2026-85731 in oras.land/oras-go/v2 - Patched by Root

Root has patched CVE-2026-85731 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-50163 CVE-2026-50163 in oras.land/oras-go/v2 - Patched by Root

Root has patched CVE-2026-50163 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...

CVE-2026-101014 Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcutilcleanup in the library libopendmarc/opendmarcutil.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be...

ROOT-APP-NPM-CVE-2026-9697 CVE-2026-9697 in undici - Patched by Root

Root has patched CVE-2026-9697 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-6734 CVE-2026-6734 in undici - Patched by Root

Root has patched CVE-2026-6734 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9678 CVE-2026-9678 in undici - Patched by Root

Root has patched CVE-2026-9678 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9679 CVE-2026-9679 in undici - Patched by Root

Root has patched CVE-2026-9679 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-13697 CVE-2026-13697 in undici - Patched by Root

Root has patched CVE-2026-13697 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-12151 CVE-2026-12151 in undici - Patched by Root

Root has patched CVE-2026-12151 in the undici package for Root:npm. Multiple fixed versions available...

SUSE-SU-2026:3843-2 Security update for suseconnect-ng

This update for suseconnect-ng fixes the following issue: - Update version to 1.23.0: - Use product identifier for product migrations. bsc1268596 - Switch to using go1.26-openssl as the default Go version to install to support building the package jscSCC-843, bsc1268900. - Fix flag parsing so tha...

CVE-2026-82379 Apache Roller: WSSE digest authentication headers can be replayed

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...

CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82381 Apache Roller: Stored cross-site scripting in the authoring UI

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...

CVE-2026-82382 Apache Roller: Reflected cross-site scripting in the frontpage directory parameter

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the...

CVE-2026-82383 Apache Roller: Anonymous setup action allows frontpage configuration tampering

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...

CVE-2026-82384 Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is...

CVE-2026-82375 Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

Server-Side Request Forgery SSRF in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standar...