OPENSUSE-SU-2026:11049-1 liburiparser1-1.0.2-1.1 on GA media

These are all security issues fixed in the liburiparser1-1.0.2-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-6733: Time-of-check Time-of-use (TOCTOU) Race Condition

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it...

Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issues CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7verify bsc1266357. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can ru...

SUSE-SU-2026:2404-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7verify bsc1266357. - CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption bsc1266349. - CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption bsc1266341....

Security update for openssl-1_1

This update for openssl-11 fixes the following issues: CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7verify bsc1266357. CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption bsc1266349. CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption bsc1266341...

OPENSUSE-SU-2026:11043-1 python313-distributed-2026.6.0-1.1 on GA media

These are all security issues fixed in the python313-distributed-2026.6.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11034-1 perl-Crypt-PBKDF2-0.261630-1.1 on GA media

These are all security issues fixed in the perl-Crypt-PBKDF2-0.261630-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11037-1 quickjs-20260604-1.1 on GA media

These are all security issues fixed in the quickjs-20260604-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11036-1 python311-zeroconf-0.149.16-1.1 on GA media

These are all security issues fixed in the python311-zeroconf-0.149.16-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11035-1 python311-aiosmtplib-5.1.1-1.1 on GA media

These are all security issues fixed in the python311-aiosmtplib-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11027-1 python311-tornado6-6.5.7-1.1 on GA media

These are all security issues fixed in the python311-tornado6-6.5.7-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11021-1 kitty-0.47.3-1.1 on GA media

These are all security issues fixed in the kitty-0.47.3-1.1 package on the GA media of openSUSE Tumbleweed...

go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak

A flaw was found in OpenTelemetry-Go before schema package version 0.0.17. ParseFile in go.opentelemetry.io/otel/schema/v1.0 and v1.1 opens a schema file and passes it to Parse without closing it, leaking one file descriptor per successful call. Repeated parsing in a long-running process can...

OPENSUSE-SU-2026:11014-1 kernel-devel-7.0.12-1.1 on GA media

These are all security issues fixed in the kernel-devel-7.0.12-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11015-1 kubevirt-container-disk-1.8.3-1.1 on GA media

These are all security issues fixed in the kubevirt-container-disk-1.8.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11017-1 perl-GD-2.860.0-1.1 on GA media

These are all security issues fixed in the perl-GD-2.860.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-47170

Garlic-Hub is affected by a CVE-2026-47170 SSRF in the uploadFromUrl endpoint. Prior to version 1.1 , authenticated users could cause the server to issue arbitrary HTTP requests to internal services, enabling internal port scanning, service fingerprinting, and retrieval of internal HTTP responses...

EUVD-2026-36288

Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port...

CVE-2026-6338: Inconsistent Interpretation of HTTP Requests

A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...

PT-2026-49088

Name of the Vulnerable Software and Affected Versions GD for Perl versions prior to 2.86 Description The make filehandle function in GD::Image uses Perl's 2-arg open to process filename arguments. This allows OS command injection and file overwrite if a filename begins or ends with a pipe e.g., "...