Open Source Vulnerabilities

sleuthkit

CVE-2026-120453 affecting package sleuthkit 4.12.1-2

sleuthkit

CVE-2026-120454 affecting package sleuthkit 4.12.1-2

libgphoto2

CVE-2026-120452 affecting package libgphoto2 2.5.31-1

libgphoto2

CVE-2026-120451 affecting package libgphoto2 2.5.31-1

quickjs-ng

quickjs-ng

quickjs-ng

netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free

quickjs-ng

quickjs-ng

quickjs-ng

libgphoto2, libgphoto2, libgphoto2, libgphoto2, libgphoto2, libgphoto2, libgphoto2, libgphoto2

sleuthkit, sleuthkit, sleuthkit, sleuthkit, sleuthkit, sleuthkit, sleuthkit, sleuthkit

sleuthkit, sleuthkit, sleuthkit, sleuthkit, sleuthkit, sleuthkit, sleuthkit, sleuthkit

rapidyaml, rapidyaml

kvazaar, kvazaar

python-jose, python-jose

libgphoto2, libgphoto2, libgphoto2, libgphoto2, libgphoto2, libgphoto2, libgphoto2, libgphoto2

netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free

netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free, netpbm-free

libinih, libinih, libinih, libinih, libinih, libinih

libaec, libaec, libaec, libaec, libaec, libaec, libaec

User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own

crossplane-provider-opentofu

Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode

NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

httplib2

CVE-2026-59939 in httplib2 - Patched by Root

httplib2

AIKIDO-2026-883745 in httplib2 - Patched by Root

Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation

org.springframework:spring-expression, org.springframework:spring-web

TuxCare security update for org.springframework (2 CVEs)

org.springframework:spring-expression

TuxCare security update for org.springframework:spring-expression (1 CVE)

pyOpenSSL

CVE-2026-27459 in pyOpenSSL - Patched by Root

Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls

Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content

LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key