EUVD-2025-211010

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

openssl: AES-OCB IV Ignored on EVP_Cipher() Path

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...

Security update for python-GitPython (important)

openSUSE security update: security update for python-gitpython ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21874-1 Rating: important References: bsc1273357 bsc1273358 bsc1273359 bsc1273364 bsc1273414 bsc1273498 bsc1275745 bsc1275746 bsc1275747...

Security update for rabbitmq-server (important)

openSUSE security update: security update for rabbitmq-server ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21903-1 Rating: important References: bsc1266465 bsc1271318 bsc1271336 bsc1271337 bsc1271338 bsc1271339 bsc1271340 bsc1271343 bsc1271344...

CVE-2026-63406

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

CVE-2026-63406

AnyCable versions prior to 1.6.15 contain a confidentiality issue in its telemetry subsystem. The file telemetry/config.go embeds a hardcoded public authToken ("secret") used to authenticate to telemetry.anycable.io, while clusterFingerprint() in telemetry/telemetry.go incorporates raw CLI argume...

CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-89058 Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

CVE-2026-89058: Permissive Cross-domain Policy with Untrusted Domains

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

EUVD-2026-79523

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs. This bulletin provides patch information to address the vulnerabilities Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of confidentiality...

tomcat11-11.0.25-1.1 on GA media (moderate)

tomcat11-11.0.25-1.1 on GA media Announcement ID: openSUSE-SU-2026:11761-1 Rating: moderate Cross-References: CVE-2026-65182 CVE-2026-65183 CVE-2026-65637 CVE-2026-65905 CVE-2026-65927 CVE-2026-66299 CVE-2026-66422 CVE-2026-68525 CVE-2026-68569 CVE-2026-68763 CVE-2026-73180 CVSS scores:...

CVE-2026-3869

CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...

EUVD-2026-76132

CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...

The vulnerability of the sctp_wait_for_connect() function in the net/sctp/socket.c module of the Linux operating system’s SCTP protocol implementation allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sctpwaitforconnect function in the net/sctp/socket.c module of the Linux operating system’s SCTP protocol implementation is related to the lack of measures taken to neutralize numerous internal special elements. Exploiting this vulnerability can allow an attacker to...

SUSE CVE-2026-23935

A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScript HttpRequest logic, leading to potential confidentiality loss...