c3p0: c3p0: Remote code execution via deserialization vulnerability

A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...

io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining

A flaw was found in Netty. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending numerous pipelined HTTP/1.1 requests over a single connection while withholding reads. Netty's HTTP server codec stores unanswered requests in an internal queue...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams

A flaw was found in Netty. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exhausting server memory. Because the SPDY session handler does not restrict the number of concurrent streams initiated by a remote peer, an attacker can transmit an excessive volume of stre...

SUSE CVE-2026-79608

The workaround for XSA-433 Zenbleed, CVE-2023-20593 was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see:...

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...

SUSE CVE-2026-92892

Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later...

SUSE CVE-2026-95124

Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled loadinibuffer utility and stripinicache...

SUSE CVE-2026-95502

A Git server that Grafana's Git Sync provisioning is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses uncontrolled resource consumption. Exploitation requires an administrator to have configured Git Sync with that server...

SUSE CVE-2026-98405

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

SUSE CVE-2026-98419

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...

SUSE CVE-2026-102832

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...

SUSE CVE-2026-105236

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI nam...

SUSE CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

SUSE CVE-2026-109964

ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage in coders/pict.c on 32-bit builds due to pointer arithmetic overflow. Attackers can supply a crafted PICT file with maximized row, column and bytes-per-line values to bypass bounds checks and...

SUSE CVE-2026-110237

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands tha...

SUSE CVE-2026-110858

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack= to execute OS commands as the calling process over...

SUSE CVE-2026-110925

CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583...

rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...

rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...