SUSE-SU-2026:23876-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276722. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh:...

OPENSUSE-SU-2026:21879-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272118. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ss...

SUSE-SU-2026:23924-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276722. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh:...

CVE-2026-18911

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

PT-2026-95273

Name of the Vulnerable Software and Affected Versions GPTranslate – Multilingual AI Translation Agent for WordPress versions prior to 2.34.7 Description Sensitive information exposure occurs via the enqueue frontend scripts function. Unauthenticated attackers can extract plaintext third-party AI...

PT-2026-95447

Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 ART versions 9.0 through 9.0.0.2 Description Cross-site scripting allows users to embed arbitrary JavaScript code in the Web UI. This can alter the intended functionality of the applicati...

PT-2026-95449

Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 ART versions 9.0 through 9.0.0.2 Description An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI. This cross-site scripting issue allows the attacker to alter...

CVE-2026-1029: Improper Neutralization of Input During Web Page Generation

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

OPENSUSE-SU-2026:11811-1 amazon-ssm-agent-3.3.5390.0-1.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.5390.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-95448

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data...

CVE-2025-15399: Cross-Site Request Forgery (CSRF)

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

PT-2026-101284

Security vulnerability affects the rancher-agent package. This issue is resolved in later releases. See references for vulnerability details...

EulerOS Virtualization 2.11.0 : polkit (EulerOS-SA-2026-3539)

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be...

EulerOS Virtualization 2.11.1 : polkit (EulerOS-SA-2026-3452)

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be...

PT-2026-95229

Name of the Vulnerable Software and Affected Versions ManageEngine DataSecurity Plus versions prior to 6310 Description An agent authentication bypass exists that allows unenrolled agents to send requests without proper authentication. Recommendations Update ManageEngine DataSecurity Plus to...

PT-2026-95437

Name of the Vulnerable Software and Affected Versions IBM Common Licensing Agent versions 9.0 through 9.0.0.2 IBM ART versions 9.0 through 9.0.0.2 Description Cross-site request forgery allows an attacker to execute malicious and unauthorized actions by transmitting requests from a user that the...

CVE-2026-89278: Exposure of Sensitive Information to an Unauthorized Actor

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueuefrontendscripts. This makes it possible for unauthenticated attackers to...

APort Vault: Benchmarking AI Agent Payment Authorization with the Open Agent Passport

APort Vault is a benchmark for payment authorization in tool-using AI agents. It replays 4,371 attacks written by humans against a live payment agent during a public capture-the-flag event, across 14 models from 8 labs, five policy configurations and two replay tracks, with and without a...

CVE-2026-1030: Generation of Error Message Containing Sensitive Information

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data...

CVE-2026-1037: Improper Neutralization of Input During Web Page Generation

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...