OPENSUSE-SU-2026:20854-1 Security update for rqlite

This update for rqlite fixes the following issues: Changes in rqlite: - Update to version 10.2.0: Support verifying mTLS peer Common Name Console supports restore from SQLite data Console "count rows" respects current Tables Expand/Collapse state Console supports dropping indexes Further Console...

CVE-2026-8643

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

EUVD-2026-33682

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

CVE-2026-8643

The pip package installer for Python is vulnerable to a path traversal flaw caused by incorrect pathname restrictions. When installing a malicious Python wheel containing specially crafted entry-point names using absolute paths or directory traversal, pip may write generated script wrappers outsi...

CVE-2026-8643 pip can extract console_scripts and gui_scripts outside installation directory

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

CVE-2026-8643 pip can extract console_scripts and gui_scripts outside installation directory

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

CVE-2026-8643 pip can extract console_scripts and gui_scripts outside installation directory

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

CVE-2026-8643

pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.5) +5 more potentially affected by CVE-2026-34197 +1 more via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-34197, CVE-2026-45505 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-17151886...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.5) +5 more potentially affected by CVE-2026-42588 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-42588 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-17151887...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.5) +5 more potentially affected by CVE-2026-49270 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-49270 Source advisory: SNYK:JAVA-ORGAPACHEACTIVEMQ-17151888...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.5) +5 more potentially affected by CVE-2026-49270 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-49270 Source advisory: OSV:GHSA-HF52-78X8-6W3W...

com.webtide.hightide:auctiondemo (>=6.1h.4-beta, <=6.1h.7), com.webtide.hightide:hightide-resources (>=6.1h.4-beta, <=6.1h.7) +8 more potentially affected by CVE-2026-42253 via org.apache.activemq:activemq-web (4.1.1)

org.apache.activemq:activemq-web MAVEN version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:activemq-web and may be impacted: - com.webtide.hightide:auctiondemo =6.1h.4-beta, =6.1h.4-beta, =6.1h.4-beta, =6.1h.4-beta, =1.1.0...

org.apache.activemq:activemq-osgi (>=6.0.0, <=6.2.5), org.apache.activemq:activemq-web-console (>=6.0.0, <=6.2.5) +2 more potentially affected by CVE-2026-42253 via org.apache.activemq:activemq-web (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-web MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-42253 Source advisory: OSV:GHSA-8WM6-6FQH-PHMC...

org.apache.activemq:activemq-osgi (>=6.0.0, <=6.2.5), org.apache.activemq:activemq-web-console (>=6.0.0, <=6.2.5) +2 more potentially affected by CVE-2026-42253 via org.apache.activemq:activemq-web (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-web MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-42253 Source advisory: GHSA-8WM6-6FQH-PHMC...

Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow...

GHSA-8WM6-6FQH-PHMC Apache ActiveMQ, Apache ActiveMQ Web have a Cross-site Scripting issue

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies every JMS message property into an HTTP response header without any validation. This can allow...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.5) +5 more potentially affected by CVE-2026-34197 +1 more via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-34197, CVE-2026-45505 Source advisory: GHSA-V853-W46P-FV2H...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.5) +5 more potentially affected by CVE-2026-42588 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-42588 Source advisory: OSV:GHSA-HG6C-8MVR-JQC9...

com.espertech:esperio-springjms (9.0.0), org.apache.activemq.tooling:activemq-maven-plugin (>=6.0.0, <=6.2.5) +5 more potentially affected by CVE-2026-45505 via org.apache.activemq:activemq-all (>=6.0.0, <=6.2.5)

org.apache.activemq:activemq-all MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.2.5 Source cves: CVE-2026-45505 Source advisory: OSV:GHSA-V853-W46P-FV2H...