201899 matches found
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...
CVE-2026-94444
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and...
CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...
CVE-2026-107714
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...
CVE-2026-107399
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...
rsync: Fix of 5 CVEs
CVE-2026-53790: refuse a shell-active RSYNCCONNECTPROG %H host and quote it; escape backtick, newline and carriage return in remote-shell arguments - CVE-2026-53793: confine a "/./" inner-module chroot: secure opens, changedir, chmod, rename, delta-basis opens and alt-dest basis stats, resolved...
vim: Fix of 3 CVEs
CVE-2026-73072: fix heap buffer overflow in setsofo with a crafted spell file upstream 9.2.0846 - CVE-2026-73076: fix arbitrary command execution via a crafted .VimballRecord vimball member upstream 9.2.0847 - CVE-2026-73078: fix Ex command injection via crafted netrw bookmark/history menu...
Security update for ghostscript
This update for ghostscript fixes the following issue: CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption by supplying crafted PDFs bsc1280620. Patch Instructions: To install this SUSE update use the SUSE recommended installation...
CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...
CVE-2026-107715
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...
CVE-2026-107714
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...
CVE-2026-87980 Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs...
CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
GHSA-9QF2-26P9-2Q2Q vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2026-47892 vulnerabilities
Vulnerabilities for packages: thingsboard...
GHSA-JGGR-W7FW-PC2J vulnerabilities
Vulnerabilities for packages: langfuse-fips, dotstatsuite-supercore, sqlpad, langfuse...
CVE-2026-102414 vulnerabilities
Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, nextcloud-server, commercial-gitlab-rails-ee...
GHSA-477H-4R7F-FVRX vulnerabilities
Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, nextcloud-server, commercial-gitlab-rails-ee...
CVE-2026-106452 vulnerabilities
Vulnerabilities for packages: knative-kafka-broker-fips, seata, pinot-fips, wildfly, sonarqube, cassandra-reaper, strimzi-kafka-operator, cassandra-fips, pinot, kafka-fips, traccar, cruise-control-fips, apache-polaris-fips, datahub-frontend, hono, spark-fips, druid, kafka, wazuh-indexer,...
CVE-2026-106453 vulnerabilities
Vulnerabilities for packages: knative-kafka-broker-fips, seata, pinot-fips, wildfly, sonarqube, cassandra-reaper, strimzi-kafka-operator, cassandra-fips, pinot, kafka-fips, traccar, cruise-control-fips, apache-polaris-fips, datahub-frontend, hono, spark-fips, druid, kafka, wazuh-indexer,...