Open Source Vulnerabilities

sonarqube

Security fix for GHSA-9342-92gg-6v29 applied in: sonarqube 26.4.0.121862-r1

sonarqube

Security fix for GHSA-6v53-7c9g-w56r applied in: sonarqube 26.4.0.121862-r1

sonarqube

Security fix for GHSA-w9fj-cfpg-grvv applied in: sonarqube 26.4.0.121862-r0

sonarqube, sonarqube

In Jakarta Mail versions prior to 2

sonarqube

Deserialization of untrusted data vulnerability in QOS

sonarqube

Path-traversal vulnerability in QOS

sonarqube

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials

sonarqube

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials

sonarqube

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled

elixir-lang

gcc-11, gcc-12, gcc-12, gcc-12, gcc-13, gcc-13, gcc-14, gcc-14, gcc-15, gcc-16

elixir-lang, elixir-lang

gcc

CVE-2026-115456 affecting package gcc 13.2.0-7

sonarqube

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver

elixir-lang, elixir-lang, elixir-lang

elixir

CVE-2026-109821 affecting package elixir 1.16.1-3

sonarqube

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user

sonarqube

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130)

elixir, elixir, elixir

elixir, elixir, elixir

elixir, elixir, elixir

gcc-3.3, gcc-4.7, gcc-4.8, gcc-defaults, gcc-mingw-w64, gccgo-4.9, gcc-5, gcc-5-cross, gcc-defaults, gccgo-6, gcc-3.3, gcc-4.7, gcc-4.7-armel-cross, gcc-4.7-armhf-cross, gcc-4.8, gcc-4.8-arm64-cross, gcc-4.8-armhf-cross, gcc-4.8-powerpc-cross, gcc-4.8-ppc64el-cross, gcc-4.9, gcc-4.9-cross, gcc-5-cross-ports, gcc-arm-linux-androideabi, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-i686-linux-android, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-snapshot, gcc-7, gcc-7-cross, gcc-8, gcc-8-cross, gcc-defaults, gcc-3.3, gcc-4.8, gcc-5, gcc-5-cross, gcc-5-cross-ports, gcc-6, gcc-6-cross, gcc-6-cross-ports, gcc-7-cross-ports, gcc-8-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-snapshot, gcc-10, gcc-10-cross, gcc-9, gcc-9-cross, gcc-defaults, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-3.3, gcc-7, gcc-8, gcc-8-cross, gcc-8-cross-ports, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-xtensa-lx106, gcc-10, gcc-10-cross, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-3.3, gcc-9, gcc-9-cross, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-xtensa-lx106, gcc-10, gcc-10-cross, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-11, gcc-11-cross, gcc-11-cross-mipsen, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-mipsen, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-3.3, gcc-9, gcc-9-cross, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot

sonarqube

flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input

sonarqube

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)

sonarqube

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query

sonarqube

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure

sonarqube

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker

sonarqube

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)

grafana-alloy

github

argo-cd

Security fix for GHSA-2v5j-vhc3-9cwm applied in: argo-cd 3.0.16-r0

argo-cd

Security fix for GHSA-93mq-9ffx-83m2 applied in: argo-cd 3.0.16-r0

ruby

URI is a module providing classes to handle Uniform Resource Identifiers

argo-cd

compress provides various compression algorithms

Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build

Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build

Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

@modelcontextprotocol/server, @modelcontextprotocol/sdk, @rootio/modelcontextprotocol__server, @rootio/modelcontextprotocol__sdk

CVE-2026-111768 in @modelcontextprotocol/server - Patched by Root

@modelcontextprotocol/sdk, @rootio/modelcontextprotocol__sdk

CVE-2026-111767 in @modelcontextprotocol/sdk - Patched by Root

@modelcontextprotocol/sdk, @modelcontextprotocol/server, @modelcontextprotocol/node, @rootio/modelcontextprotocol__sdk, @rootio/modelcontextprotocol__server, @rootio/modelcontextprotocol__node

GHSA-f897-62hf-6gxq in @modelcontextprotocol/sdk - Patched by Root

@modelcontextprotocol/sdk, @rootio/modelcontextprotocol__sdk

CVE-2026-104850 in @modelcontextprotocol/sdk - Patched by Root

laravel/framework

TuxCare security update for laravel/framework (1 CVE)

pillow

TuxCare security update for pillow (7 CVEs)

openssh

Security update for openssh

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197)

sonarqube

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33)