Open Source Vulnerabilities

Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser

libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder

L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes

rapidyaml through 0.16.0 Out-of-Bounds Write via ParseEngine::_add_annotation()

The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header

libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion

libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver

LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

Outline before 1.12.0 Improper Access Control via Public Document Shares

DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code

madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API

madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware

GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop

GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results

ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass

OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

QuickJS-NG before 0.16.0 Memory Leak via Atomics.store

QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort

QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration

org.springframework:spring-expression, org.springframework:spring-web

TuxCare security update for org.springframework (2 CVEs)

Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController

Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass

MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route

Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint

inih before r63 Stack Buffer Under-Read in ini_parse_stream Discard Loop

pip

AIKIDO-2026-949486 in pip - Patched by Root

pip

CVE-2026-6357 in pip - Patched by Root

org.springframework:spring-beans, org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (7 CVEs)

pip

CVE-2026-8643 in pip - Patched by Root

pip

CVE-2026-3219 in pip - Patched by Root

pip

CVE-2021-3572 in pip - Patched by Root

pip

CVE-2025-8869 in pip - Patched by Root

cadvisor

Security update for cadvisor

org.springframework:spring-context, org.springframework:spring-core, org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc, org.springframework:spring-websocket

TuxCare security update for org.springframework (7 CVEs)

org.springframework:spring-web, org.springframework:spring-webmvc

TuxCare security update for org.springframework (3 CVEs)

pip

CVE-2023-5752 in pip - Patched by Root

org.springframework:spring-web

TuxCare security update for org.springframework:spring-web (1 CVE)

crossplane-provider-opentofu

org.springframework:spring-core

TuxCare security update for org.springframework:spring-core (1 CVE)

crossplane-provider-opentofu-fips

crossplane-provider-opentofu-fips

org.springframework:spring-expression, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (3 CVEs)

Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking

io.netty:netty-codec-dns, io.netty:netty-codec-haproxy, io.netty:netty-codec-http, io.netty:netty-codec-http2, io.netty:netty-codec-mqtt, io.netty:netty-codec-redis, io.netty:netty-codec-smtp, io.netty:netty-common, io.netty:netty-handler, io.netty:netty-transport-sctp

TuxCare security update for io.netty (17 CVEs)

org.springframework:spring-beans, org.springframework:spring-context, org.springframework:spring-core, org.springframework:spring-expression, org.springframework:spring-framework-bom, org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (13 CVEs)

handlebars