Updated librabbitmq packages fix security vulnerabilities

The updated packages fix security vulnerabilities: An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for amqp-publish or amqp-consume and are thus visible to local attackers by listing a proce...

CVE-2026-69152

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

Security update for vim

This update for vim fixes the following issues: Security issues fixed: CVE-2026-59856: arbitrary code execution via PHP omni-completion bsc1271194. CVE-2026-59857: out-of-bounds write in SAL soundfolding bsc1271195. CVE-2026-59858: arbitrary code execution via C omni-completion bsc1271193. Non...

EUVD-2026-52018

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

Joern 4.0.594

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-69244: Uncontrolled Resource Consumption

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

PT-2026-76137

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API heif image handle get image tiling when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In debug builds this trips the ispe &&...

ROS-20260803-73-0024

The vulnerability of the initf2fsfs function in the fs/f2fs/super.c module of the F2FS file system support module in Linux kernel relates to pointer manipulation. Exploiting this vulnerability could allow an attacker to trigger a service failure...

burner-net v1.3.0

BurnerNet Zero-trust, anti-forensic HTTP client. Wipes secrets. Severs traces. CPR in a Stealth Tank. 👻 BurnerNet is a C++20 anti-forensic HTTP client. It provides a fluent, CPR-like API for apps that cannot fully trust the local machine—physically wiping secrets from RAM and severing execution...

SUSE CVE-2026-28377

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3. Thanks to williamgoodfellow for reporting this vulnerability...

OESA-2026-3197 mariadb-connector-c security update

This package is used for connecting C/C++ programs to MariaDB and MySQL database. Security Fixes: MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysqlrealescapestring and sending...

Oracle Linux 10 : nodejs24 (ELSA-2026-35841)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-35841 advisory. 1:24.18.0-1.0.1 - Update upstream references 1:24.18.0-1 - Update to version 24.18.0 1:24.14.1-3 - De-bundle c-ares and libuv Tenable has extracted t...

Oracle Linux 9 : nodejs:22 (ELSA-2026-47058)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47058 advisory. - Fix CVE-2026-59873, CVE-2026-59874 node-tar by rebasing npm's bundled tar to 7.5.19 - Fix CVE-2026-13149 brace-expansion in npm's bundled...

EUVD-2026-51628

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF Authentication Server Function does not validate the supiOrSuci field in UE authentication requests. Null bytes \x00 and other control characters pass through JSON parsing unchanged and are forwarded...

CVE-2026-53503

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C...

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Summary Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C code triggers undefined behavior; on x8664 this reliably results in a...

GHSA-CQJP-JF4R-H5Q9 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Summary Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C code triggers undefined behavior; on x8664 this reliably results in a...

CVE-2026-53503 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C...

CVE-2026-53503 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C...

CVE-2026-53503

Thumbor CVE-2026-53503 documents a vulnerability in the filters:convolution filter prior to 7.8.0 where the user-supplied columns value is passed to a C extension (thumbor/ext/filters/_convolution.c) as a divisor without validating that columns > 0. If columns is 0, the C code triggers undefin...