Security update for libvirt (important)

openSUSE security update: security update for libvirt ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21738-1 Rating: important References: bsc1274576 bsc1274946 bsc1275264 bsc1275265 bsc1275863 Cross-References: CVE-2026-18917 CVE-2026-61477...

CVE-2026-86673: Use of Hard-coded Credentials

A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...

CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

Malicious Package

Overview hyper-kube-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-78043

A flaw was found in OpenVPN. The Windows Interactive Service allows local authenticated users to bypass security restrictions and load unauthorized configuration files. By crafting special paths, an attacker can manipulate the service's configuration, potentially leading to privilege escalation...

EUVD-2026-72279

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-81830

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation...

CVE-2026-78043

OpenVPN's Windows Interactive Service in versions 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint, enabling them to load arbitrary configuration files via specially crafted paths. The CVSS 4.0 base score is 5.6 (MEDIUM) with a loc...

CVE-2026-78043

The Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

EUVD-2026-72275

The Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

CVE-2026-78043

The Windows Interactive Service in OpenVPN 2.7alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

PT-2026-86639

The Windows Interactive Service in OpenVPN 2.7 alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths...

LOYTEC L-IP BACnet/IP Routers Improper Authentication (CVE-2026-12504)

The PAM configuration of a LOYTEC L-IP BACnet/IP router uses the 'pamunix.so nullok' option, which permits authentication against any local account that has an empty password field in '/etc/passwd'. A local attacker can leverage an account left without a password to authenticate as uid=0 and obta...

Linux Distros Unpatched Vulnerability : CVE-2026-80903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails...

PT-2026-86933

Name of the Vulnerable Software and Affected Versions knowns versions prior to 0.30.0 Description Failure to validate the settings.lsp.languages binary field in project configuration files allows the execution of arbitrary binaries. An attacker can achieve this by crafting a malicious...

SUSE CVE-2026-50891

Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request...

SUSE CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

SUSE CVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...