cockpit-packages-4.1-4.1 on GA media (moderate)

cockpit-packages-4.1-4.1 on GA media Announcement ID: openSUSE-SU-2026:10251-1 Rating: moderate Cross-References: CVE-2026-25547 CVSS scores: CVE-2026-25547 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25547 SUSE : 8.7...

EUVD-2026-8517

The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write files outside the intended backup directory. A path...

OPENSUSE-SU-2026:10252-1 cockpit-repos-4.7-4.1 on GA media

These are all security issues fixed in the cockpit-repos-4.7-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10213-1 libxml2-16-2.14.5-4.1 on GA media

These are all security issues fixed in the libxml2-16-2.14.5-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10207-1 frr-10.2.1-4.1 on GA media

These are all security issues fixed in the frr-10.2.1-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10200-1 python310-3.10.19-4.1 on GA media

These are all security issues fixed in the python310-3.10.19-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10086-1 openCryptoki-3.26.0-4.1 on GA media

These are all security issues fixed in the openCryptoki-3.26.0-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10061-1 libsndfile-devel-1.2.2-4.1 on GA media

These are all security issues fixed in the libsndfile-devel-1.2.2-4.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-69990

phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in removefile.php. The parameter file can cause any file to be deleted...

WordPress Penci Recipe plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Penci Recipe versions = 4.1...

CVE-2023-49859

Missing Authorization vulnerability in Marcus aka @msykes Login With Ajax login-with-ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through = 4.1...

OPENSUSE-SU-2026:10018-1 gimp-3.0.6-4.1 on GA media

These are all security issues fixed in the gimp-3.0.6-4.1 package on the GA media of openSUSE Tumbleweed...

rsync-3.4.1-4.1 on GA media (moderate)

rsync-3.4.1-4.1 on GA media Announcement ID: openSUSE-SU-2025:15827-1 Rating: moderate Cross-References: CVE-2025-10158 CVSS scores: CVE-2025-10158 SUSE : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

OPENSUSE-SU-2025:15827-1 rsync-3.4.1-4.1 on GA media

These are all security issues fixed in the rsync-3.4.1-4.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2025-203601

Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protect WP Admin: from n/a through = 4.1...

OPENSUSE-SU-2025:15812-1 libpoppler-cpp2-25.09.1-4.1 on GA media

These are all security issues fixed in the libpoppler-cpp2-25.09.1-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15770-1 bash-git-prompt-2.7.1-4.1 on GA media

These are all security issues fixed in the bash-git-prompt-2.7.1-4.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-59111

Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4...

EUVD-2025-198002

Windu CMS is vulnerable to Cross-Site Request Forgery in user editing functionality. Implemented CSRF protection mechanism can be bypassed by using CSRF token of other user. It is worth noting that the registration is open and anyone can create an account. The vendor was notified early about this...

CVE-2025-59117

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting XSS vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. Only version 4.1 was tested and confirmed as...