SUSE-SU-2026:23192-1 Security update for rpm

This update for rpm fixes the following issue: - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot table bsc1269584...

GO-2026-6186 Path traversal via local backend encoding in github.com/rclone/rclone

Path traversal via local backend encoding in github.com/rclone/rclone...

GO-2026-6205 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik...

GO-2026-6209 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik...

GO-2026-6164 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend...

CVE-2024-58375

A flaw was found in OpenTofu. When users enable static evaluation of module sources, versions, and backend configurations, the software does not properly restrict sensitive variables and locals. This oversight can lead to the exposure of values intended to be sensitive through these configuration...

PT-2026-77318

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Backend API handlers in custom components/blueprint studio/backend/api.py return raw exception strings to authenticated Home Assistant users. These exception messages may disclose internal...

PT-2026-80410

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose...

PT-2026-80419

Path traversal via local backend encoding in github.com/rclone/rclone...

PT-2026-80438

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik...

CVE-2026-53453: Missing Authorization

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

Linux Distros Unpatched Vulnerability : CVE-2026-72151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpmbufappendsalt tpmbufappendsalt in...

PT-2026-80364

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend...

PT-2026-80431

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool in github.com/traefik/traefik...

SUSE-SU-2026:23204-1 Security update for rpm

This update for rpm fixes the following issue: - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot table bsc1269584...

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

EUVD-2026-60304

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend...

CVE-2026-74254 Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend...

CVE-2026-74254

CVE-2026-74254 is a SQL injection vulnerability in the Page Builder CK Joomla extension (by joomlack.fr), specifically in the styles model . The flaw allows an unauthenticated, remote attacker to interfere with database queries, potentially leading to data exfiltration, modification, or service d...

SUSE CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...