SUSE-SU-2026:3599-1 Security update for dracut

This update for dracut fixes the following issue: Update to version 055+suse.367.g85633e8. Securitys issue fixed: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: - Fixbase: sanitize message...

python-idna: idna: Denial of Service via specially crafted long inputs

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

php:php-fuzz-function-jit: Heap-use-after-free in zval_ptr_dtor_nogc

Detailed Report: https://oss-fuzz.com/testcase?key=4584750845853696 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-function-jit Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x7944a94efd30 Crash State: zvalptrdtornogc...

CVE-2026-64952

Velociraptor’s hunt_delete() VQL function has a permission check flaw: it allows deleting hunts because the check requires COLLECT_CLIENT (investigator) instead of DELETE_RESULTS (administrators). This misapplies access control, potentially enabling non-administrator users to delete hunts. The CV...

EUVD-2026-57159

The huntdelete VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECTCLIENT usually assigned to the "investigator" role instead of the "DELETERESULTS" permission usually only assigned to "administrators"...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

CVE-2026-73289: Incorrect Authorization

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

PT-2026-71291

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size...

PT-2026-71483

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A buffer over-read exists in the ascii SQL function, whic...

The vulnerability of the cloud service for storing immutable confidential records and logs in Azure Confidential Ledger allows a perpetrator to execute arbitrary code.

The vulnerability of cloud services for storing confidential records and logs in Azure Confidential Ledger is related to the use of dangerous methods or functions. Exploiting these vulnerabilities could allow a malicious actor to execute arbitrary code...

PT-2026-71468

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A heap buffer overflow occurs in the plperl language...

VulnCheck KEV: CVE-2026-72529

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script...

PT-2026-71289

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

SUSE CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-73247

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

CVE-2026-73247

Kestra prior to 2.0.0 has a SSRF-like issue in HttpFunction.java: the user-controlled http() URI is passed to URI.create() and used by the server-side HTTP client without restricting private, loopback, or link-local destinations. This allows an unauthenticated attacker to import and execute a flo...

Eval Injection

Overview @faker-js/faker is a Generate massive amounts of fake contextual data Affected versions of this package are vulnerable to Eval Injection via the helpers.fake function. An attacker can execute arbitrary JavaScript code by supplying specially crafted templates that access the Function...

CVE-2026-73231

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another...