SUSE CVE-2026-57897

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

SUSE CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

SUSE CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

SUSE CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

SUSE CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

SUSE CVE-2026-58196

unknown...

SUSE CVE-2026-58314

Two SSRF findings in Gitea 1.26.2...

SUSE CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

SUSE CVE-2026-58419

Notification API leaks private issue metadata after access revocation...

SUSE CVE-2026-58420

Local File Inclusion via file:// URI in Migration Restore...

SUSE CVE-2026-58423

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...

SUSE CVE-2026-58424

Permanent Fork PR Workflow Approval Gate Bypass...

SUSE CVE-2026-58428

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

SUSE CVE-2026-58429

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...

SUSE CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

SUSE CVE-2026-58437

Repository Visibility Manipulation via Git Push Options...

SUSE CVE-2026-58440

Webhooks created by a collaborator keep firing after their repo access is revoked - ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

SUSE CVE-2026-58444

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

SUSE CVE-2026-58511

Webhook Authorization Header Returned in Plaintext via API...

CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...