kernel: zram: fix use-after-free in zram_bvec_write_partial()

A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the zrambvecwritepartial function allows an asynchronous read to write into a page...

EUVD-2026-94163

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged...

CVE-2026-83540

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged...

CVE-2026-83540 wolfSSHd on Windows race condition leading to logon token reused across connections

When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

EUVD-2026-94154

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-102478

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CVE-2026-102478

In affected versions of Octopus Server , an authenticated user with permissions to modify roles can achieve privilege escalation . The vulnerability is caused by the improper validation of unsafe equivalence in inputs , allowing an attacker to weaken built-in roles and add their account to a priv...

EUVD-2026-94055

In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPorts and StreamLocalForwarding configuration options, and lack of support for file-descriptor passing and unprivileged...

CVE-2026-46434: Improper Privilege Management

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gymtrainer permission can deactivate any account in the same gym, including gymmanager and generalgymmanager accounts. The UserDeactivateView grants access to anyone holding any one of gym.managegy...

SUSE SLES12 Security Update : docker-stable (SUSE-SU-2026:4533-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4533-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header...

SUSE SLES15: docker-stable / docker-stable-bash-completion / etc (SUSE-SU-2026:4535-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4535-1 advisory. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header...

CVE-2026-76266: Improper Privilege Management

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The...

Security update for golang-github-prometheus-alertmanager (important)

openSUSE security update: security update for golang-github-prometheus-alertmanager ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22027-1 Rating: important References: bsc1266615 bsc1269834 Cross-References: CVE-2026-2303 CVE-2026-39821 CVSS score...

PT-2026-107374

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

PT-2026-107715

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

Security update for prometheus-blackbox_exporter (important)

openSUSE security update: security update for prometheus-blackboxexporter ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22026-1 Rating: important References: bsc1236515 bsc1238680 bsc1266556 bsc1279126 Cross-References: CVE-2023-45288 CVE-2025-228...

PT-2026-107514

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the gym trainer permission can deactivate any account in the same gym, including gym manager and general gym manager accounts. The UserDeactivateView grants access to anyone holding any one of gym.mana...

PT-2026-107388

Name of the Vulnerable Software and Affected Versions wolfSSH versions 1.4.15 through 1.5.0 Description In the Windows port of wolfSSHd, the Windows logon token acquired during password or public key authentication is not released before a token is acquired for a subsequent connection. This leads...