OPENSUSE-SU-2026:10458-1 MozillaFirefox-149.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-149.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10461-1 python311-nltk-3.9.4-1.1 on GA media

These are all security issues fixed in the python311-nltk-3.9.4-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2016-20038

Removed by vendor...

yTree 缓冲区错误漏洞

yTree is a terminal-based file management and directory browsing tool developed by Werner Bregulla. Versions 1.94 to 1.1 of yTree contain a buffer error vulnerability. This vulnerability stems from a stack buffer overflow, which could allow local attackers to execute arbitrary code by providing...

OPENSUSE-SU-2026:10447-1 MozillaThunderbird-140.9.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10452-1 libjavamapscript-8.6.1-1.1 on GA media

These are all security issues fixed in the libjavamapscript-8.6.1-1.1 package on the GA media of openSUSE Tumbleweed...

libtpms-devel-0.10.2-1.1 on GA media (moderate)

libtpms-devel-0.10.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10422-1 Rating: moderate Cross-References: CVE-2026-21444 CVSS scores: CVE-2026-21444 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2026-21444 SUSE : 6...

OPENSUSE-SU-2026:10454-1 python311-cryptography-46.0.6-1.1 on GA media

These are all security issues fixed in the python311-cryptography-46.0.6-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10451-1 libpng16-16-1.6.56-1.1 on GA media

These are all security issues fixed in the libpng16-16-1.6.56-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10450-1 incus-6.23-1.1 on GA media

These are all security issues fixed in the incus-6.23-1.1 package on the GA media of openSUSE Tumbleweed...

nginx-1.29.7-1.1 on GA media (moderate)

nginx-1.29.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:10423-1 Rating: moderate Cross-References: CVE-2026-27651 CVE-2026-27654 CVE-2026-27784 CVE-2026-28753 CVE-2026-28755 CVE-2026-32647 CVSS scores: CVE-2026-27651 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-27651 SU...

python311-cbor2-5.9.0-1.1 on GA media (moderate)

python311-cbor2-5.9.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10425-1 Rating: moderate Cross-References: CVE-2026-26209 CVSS scores: CVE-2026-26209 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-26209 SUSE : 8.7...

OPENSUSE-SU-2026:10455-1 python311-requests-2.33.0-1.1 on GA media

These are all security issues fixed in the python311-requests-2.33.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-34475

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass...

CVE-2026-22738

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression...

CVE-2026-34475: Incorrect Behavior Order: Validate Before Canonicalize

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass...

PT-2026-28325

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.4 Spring AI versions 1.1.0 through 1.1.3 Description Spring AI’s spring-ai-bedrock-converse component has a Server-Side Request Forgery SSRF issue within the BedrockProxyChatModel. This occurs when handling...

OPENSUSE-SU-2026:10445-1 traefik2-2.11.42-1.1 on GA media

These are all security issues fixed in the traefik2-2.11.42-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-33870: Inconsistent Interpretation of HTTP Requests

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fi...

CVE-2026-1854

The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...