Open Source Vulnerabilities

com.google.guava:guava, io.root.com.google.guava:guava

CVE-2026-102554 in com.google.guava:guava - Patched by Root

haproxy, haproxy, haproxy, haproxy

haproxy vulnerabilities

io.netty:netty-codec-http, io.netty:netty-codec-http2, io.netty:netty-codec-redis, io.netty:netty-codec-smtp, io.netty:netty-common, io.netty:netty-handler, io.netty:netty-resolver-dns

TuxCare security update for io.netty (13 CVEs)

Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook

Dockhand before 1.0.54 Path Traversal via Stack Environment Routes

svg-sanitizer before 1.1.0 XSS via animateTransform on Safari

svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes

svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping

svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph

svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag

Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass

Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http

Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing

Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters

Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors

AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()

AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config

Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser

Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments

SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization

SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass

SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass

SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses

SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner

SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession

FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly

FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry

FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2

FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token

FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel

FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel

FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX Payload

FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control

FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA

FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP