Skip to content
OpenAdvisories

Archive

18 July 2026

Vulnerabilities first published on this day (UTC), newest first.

1 result · Clear filters · Feed

  • High 7.8
    CVE-2026-9147 Public exploit

    uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata

    uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source w…