libsoup-3_0-0-3.6.6-9.1 on GA media (moderate)

libsoup-30-0-3.6.6-9.1 on GA media Announcement ID: openSUSE-SU-2026:11823-1 Rating: moderate Cross-References: CVE-2026-85197 CVE-2026-85534 CVSS scores: CVE-2026-85197 SUSE : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2026-85197 SUSE : 7.7...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtar (UTSA-2026-054042)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054042 advisory. An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc0 for a variable gnulongname, causing an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dnsmasq (UTSA-2023-001151)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001151 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. Tenable h...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003821)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003821 advisory. In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody0 may cause a denial of service due to no default limit on possib...

Intel® PROSet/Wireless WiFi Software Advisory-01468

Summary: Potential security vulnerabilities for some Intel® PROSet/Wireless WiFi Software may allow escalation of privileges, information disclosure or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2026-24911...

CVE-2026-58504 draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont in...

CVE-2026-58504 draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont in...

CVE-2026-94031

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function childprocess.exec of the file src/auth/browser.ts of the component nexusreauth MCP tool. The manipulation of the argument url results in command injection. The...

PT-2026-95941

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the ID variable within the /reviewer 0/admins/assessments/subject/btn functions.php?action=remove endpoint...

PT-2026-95943

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A flaw allows remote attackers to perform SQL injection, a technique used to interfere with the queries that an application makes to its database. This issue occurs in th...

SUSE CVE-2026-93436

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...

OPENSUSE-SU-2026:11823-1 libsoup-3_0-0-3.6.6-9.1 on GA media

These are all security issues fixed in the libsoup-30-0-3.6.6-9.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-63199 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

EUVD-2026-82534

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: microcode_ctl (UTSA-2026-110879)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-110879 advisory. Improper handling of values for some IntelR Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of privilege. Authorized adversary...

MiracleLinux 9 : microcode_ctl-20260210-1.20260812.1.el9_8 (AXSA:2026-1871:08)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1871:08 advisory. kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2025-35973 kernel: microcodectl: Intel Xeon 6...

ISC BIND 9.20.0 < 9.20.29 / 9.20.9-S1 < 9.20.29-S1 / 9.21.0 < 9.21.26 DoS (CVE-2026-77692)

The version of ISC BIND running on the remote host is 9.20.0 through 9.20.27 or 9.21.0 through 9.21.25. Supported Preview Edition releases 9.20.9-S1 through 9.20.27-S1 are also affected. It is, therefore, affected by a vulnerability : - An attacker can cause named to abort by sending a crafted...

Missing Release of Memory after Effective Lifetime

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the decode-worker process. An attacker can cause memory exhaustion by submitting requests wit...

PYSEC-0000-CVE-2026-93436

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...

PYSEC-2026-3996

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...