Open Source Vulnerabilities

multer, @rootio/multer

CVE-2026-5079 in multer - Patched by Root

Forge: Regular expression denial of service in PEM decoding (pem.decode)

Forge: TLS client crash when the server sends no certificate

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)

Forge: ASN.1 OID first arc truncation in asn1.oidToDer

react-server-dom-turbopack

TuxCare security update for react-server-dom-turbopack (2 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)

Forge: Certificate signature verified with the issuer's RSA signature scheme

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

gitlab-rails-ce-19.4

gitlab-rails-ce-19.4

gitlab-rails-ce-19.4

Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

eks-controller-fips

eks-controller-fips

linux-desktop-6.18

botan, botan, botan3, botan3

botan2

CVE-2026-118769 affecting package botan2 2.14.0-2

botan, botan, botan3, botan3

botan, botan, botan3, botan3

botan, botan, botan3, botan3

botan2

CVE-2026-118768 affecting package botan2 2.14.0-2

botan2

CVE-2026-118767 affecting package botan2 2.14.0-2

botan2

CVE-2026-118766 affecting package botan2 2.14.0-2

python3.11, python3.13, python3.14, python3.15

python-py

CVE-2026-116566 affecting package python-py 1.11.0-1

python3

CVE-2026-116566 affecting package python3 3.12.16-1

botan, botan, botan, botan

nomad, nomad

botan, botan, botan, botan

botan, botan, botan, botan

botan, botan, botan, botan

python2.7, python3.4, python3.5, python2.7, python3.5, python2.7, python3.6, python3.7, python3.8, python3.8, python2.7, python3.9, python3.10, python2.7, python3.11, python3.12, python3.14, python3.15, python3.14

nomad, nomad

speex

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Nomad allocation data migration may allow host directory permission modification via symlink following

Nomad dispatch payload writes can escape the allocation directory through symlinks

Nomad vulnerable to cross-namespace information disclosure in multiple endpoints

serialize-javascript

TuxCare security update for serialize-javascript (1 CVE)

nemo-rl-cuda-13.0-sglang

nemo-rl-cuda-13.0-sglang