SUSE CVE-2026-104066

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...

SUSE CVE-2026-104067

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes,...

EUVD-2026-115348

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench VEW could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to...

CVE-2026-119085 Template injection in the publishing component of awslabs Virtual Engineering Workbench

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench VEW could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to...

CVE-2026-119085 Template injection in the publishing component of awslabs Virtual Engineering Workbench

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench VEW could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to...

CVE-2026-119085

The awslabs Virtual Engineering Workbench (VEW) is vulnerable to a template injection flaw in its publishing component. The root cause is the improper neutralization of special elements used in a template engine, which allows a remote authenticated third party to execute arbitrary code using the ...

CVE-2026-119085 Template injection in the publishing component of awslabs Virtual Engineering Workbench

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench VEW could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to...

CVE-2026-120433

A flaw was found in Netpbm. This vulnerability allows an attacker to achieve arbitrary code execution or cause a Denial of Service DoS by tricking a user or system into processing a specially crafted image file. A lack of boundary checking in the picttoppm utility allows a polygon with an excessi...

SUSE CVE-2026-116243

pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: CVE-2026-112307: arbitrary code execution via unescaped PHP output formatting bsc1286096. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

SUSE-SU-2026:5042-1 Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: - CVE-2026-112307: arbitrary code execution via unescaped PHP output formatting bsc1286096...

Magento-eCommerce-RCE-CVE-2015-1397

Magento Shoplift Exploit SUPEE-5344 - CVE-2015-1397 Overview This script exploits the CVE-2015-1397 vulnerability in Magento, commonly referred to as the Magento Shoplift exploit. It allows an attacker to create a new admin user in the Magento database by injecting SQL payloads. Originally writte...

Security update for python-Pillow

This update for python-Pillow fixes the following issues: CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek in MPO and DCX bsc1286802. CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek leads to unbounded allocation DoS bsc1286801. CVE-2026-96640: PD...

SUSE-SU-2026:5038-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues: - CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek in MPO and DCX bsc1286802. - CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek leads to unbounded allocation DoS bsc1286801. -...

CVE-2026-98171

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious or compromised remote server can exploit this flaw by sending specially crafted compound encrypted network responses. Due to improper bounds validation and pointer lifecycle management, the client can encounter a...

Security update for nodejs24

This update for nodejs24 fixes the following issues: Security issues fixed: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-105483: TLS certificate...

SUSE-SU-2026:5037-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Security issues fixed: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-105483: TLS...

Security update for nodejs22

This update for nodejs22 fixes the following issues: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-106069: TLS certificate hostname bypass when th...

SUSE-SU-2026:5036-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-106069: TLS certificate hostname bypass...

CVE-2026-77880

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...