CVE-2026-13320 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-runner-fips, gitlab-runner...

GHSA-M49F-RVV4-R4RV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-runner-fips, gitlab-runner...

GHSA-PGGX-2V9R-J6GM vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-runner-fips, gitlab-runner...

CVE-2026-7492 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-runner-fips, gitlab-runner...

GHSA-Q3FV-X8VG-QQM4 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, trivy-operator, trivy-operator-fips, cloudbeat...

CVE-2026-54448 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, trivy-operator, trivy-operator-fips, cloudbeat...

GHSA-VHCH-2WF3-M8RP vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, thingsboard, hadoop-fips, seata, tez, tinkerpop, apache-hop-fips, celeborn, trino, management-api-for-apache-cassandra-5.0, pinot-fips, pinot, apache-hop, management-api-for-apache-cassandra-4.1...

CVE-2026-44891 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.0, thingsboard, hadoop-fips, seata, tez, tinkerpop, apache-hop-fips, celeborn, trino, management-api-for-apache-cassandra-5.0, pinot-fips, pinot, apache-hop, management-api-for-apache-cassandra-4.1...

CVE-2026-26032

The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...

SUSE CVE-2026-15772

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-44891

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only...

SUSE CVE-2026-50151

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the...

SUSE CVE-2026-50163

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...

SUSE CVE-2026-61862

ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when a profile is displayed with the identify command and the profile value is not printable, a single byte at the end of the profile can be printed read past the profile boundary. This behavior occurs whe...

SUSE CVE-2026-61865

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation: when a specific operation fails, a small memory leak occurs...

SUSE CVE-2026-61867

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service...

EUVD-2026-44709

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via OTRUNC, and can happen before full input validation completes “truncation-before-validation...

CVE-2026-62389

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779...

Updated tmux packages fix a security vulnerability

The updated package fixes a security vulnerability: tmux image.c imagefree use after free. CVE-2026-11623...

CVE-2026-45793

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...