SUSE CVE-2026-32854

LibVNCServer versions 0.9.15 and prior fixed in commit dc78dee contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit...

web-app-security-owasp-zap

🔐 Web Application Security Testing with OWASP ZAP Author:...

Security update 5.0.7 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Non-customer-facing optimization and update golang-github-boynux-squidexporter: Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes jscPED-14971: Added compatibility for Squid 6...

SUSE-SU-2026:1010-1 Security update 5.0.7 for Multi-Linux Manager Server

This update fixes the following issues: branch-network-formula: - Update to version 1.1.0 Enable containers on SLE15SP7 Exclude podman interfaces from sysctl setting cobbler: - Compatibility fixes for tftpboot directory setup inter-server-sync: - Version 0.3.10-0 Write log to a rotated file witho...

SUSE CVE-2026-32110

SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and...

SUSE CVE-2026-33174

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request...

PT-2026-28129

Name of the Vulnerable Software and Affected Versions Sonarr versions prior to 4.0.16.2942 Description Sonarr is a PVR for Usenet and BitTorrent users. A flaw exists where authentication could be bypassed in versions with authentication disabled for local addresses Authentication Required set to:...

Linux Distros Unpatched Vulnerability : CVE-2026-32854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibVNCServer versions 0.9.15 and prior fixed in commit dc78dee contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInp...

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Impact Active Storage’s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2026-33174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through...

PT-2026-28168

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.2.1 Rails versions prior to 8.0.4.1 Rails versions prior to 7.2.3.1 Description Active Storage, used for attaching cloud and local files in Rails applications, is susceptible to a denial-of-service condition. The...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @astrojs/vercel is a Deploy your site to Vercel Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the x-astro-path header or xastropath query parameter, which allows overriding internal request paths without authentication. An...

CVE-2026-23919

A flaw was found in Zabbix Server and Proxy. This vulnerability arises from the system's reuse of JavaScript Duktape contexts, which are execution environments for JavaScript code. A regular Zabbix administrator, even without superuser privileges, can exploit this to access and leak sensitive dat...

CVE-2026-32854

A flaw was found in LibVNCServer. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted HTTP requests. The flaw exists in the HTTP proxy handlers, where missing validation of certain return values can lead to a null pointer dereference, causing...

GHSA-9F94-5G5W-GF6R vulnerabilities

Vulnerabilities for packages: efs-utils, ntpd-rs, parseable, cargo-audit, rustls-ffi, py3-xet-core, nushell, wasmcloud, buck2, ztunnel, zellij, deno, linkerd2-proxy, pixi, zizmor, linkerd2, linkerd-network-validator, linkerd-extension-init, rustup, qdrant, zed, lychee...

GHSA-394X-VWMW-CRM3 vulnerabilities

Vulnerabilities for packages: efs-utils, ntpd-rs, parseable, cargo-audit, rustls-ffi, py3-xet-core, nushell, wasmcloud, buck2, ztunnel, deno, linkerd2-proxy, pixi, zizmor, linkerd2, linkerd-network-validator, linkerd-extension-init, rustup, qdrant, zed, lychee...

GHSA-9F94-5G5W-GF6R vulnerabilities

Vulnerabilities for packages: py3-xet-core, qdrant, linkerd2, mise, zellij, efs-utils, nushell, zed, deno, wasmcloud, buck2, zizmor, ztunnel, ntpd-rs, linkerd2-proxy, linkerd-extension-init, parseable, linkerd2-cni-plugin, rustup, garage, pixi, cargo-audit, komodo, lychee, rustls-ffi,...

GHSA-394X-VWMW-CRM3 vulnerabilities

Vulnerabilities for packages: py3-xet-core, qdrant, linkerd2, mise, efs-utils, nushell, zed, deno, wasmcloud, buck2, zizmor, ztunnel, ntpd-rs, linkerd2-proxy, linkerd-extension-init, parseable, linkerd2-cni-plugin, rustup, garage, pixi, cargo-audit, komodo, lychee, rustls-ffi,...

DEBIAN-CVE-2026-23919

For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to confidentiality loss where a regular non-super Zabbix administrator leaks data for hosts they do not have access to. A fix has been released tha...

CVE-2026-23919

For performance reasons Zabbix Server/Proxy reuses JavaScript Duktape contexts used in script items, JavaScript reprocessing, Webhooks. This can lead to confidentiality loss where a regular non-super Zabbix administrator leaks data for hosts they do not have access to. A fix has been released tha...