CVE-2026-92001

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-84384

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a crafted HEIF or AVIF file containing malicious metadata or image data. This could cause the application to consume an unbounded amount of memory during...

EUVD-2026-85174

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-92001

The Apache Sling XSS component is vulnerable to an XML entity expansion attack due to improper restriction of recursive entity references in DTDs. This issue affects versions before 2.4.12 . To remediate the vulnerability, users are recommended to upgrade to version 2.4.12 . No specific exploit i...

CVE-2026-57225

A flaw was found in Suricata, a network Intrusion Detection System. A NULL pointer dereference vulnerability exists when loading JSON or NDJSON datasets. This occurs because the system incorrectly assumes a configured valuekey will always resolve to a string. A trusted or untrusted dataset or rul...

CVE-2026-63635

A flaw was found in OpenImageIO. A remote attacker could exploit this by crafting a malicious PSD Photoshop Document file with an invalid color mode. When processed by OpenImageIO with raw color or raw data enabled, this crafted file bypasses validation, leading to an out-of-bounds read and...

CVE-2026-61723

A flaw was found in FluidSynth. The native DLS parser, when processing ptbl chunks, does not properly validate the size calculation, leading to an integer overflow. A remote attacker could craft a malicious DLS file that, when processed, causes the application to attempt to allocate an excessive...

CVE-2026-61722

A flaw was found in FluidSynth, a software synthesizer. This vulnerability, an integer overflow, exists in the native DLS Downloadable Sounds parser when it validates articulation chunks. A remote attacker could exploit this by providing a specially crafted DLS file, which causes the parser to...

CVE-2026-57224

A flaw was found in Suricata. The DHCP and RDP parsers fail to record packet direction for stateless transactions. This allows a network sensor observing only one direction of traffic to accumulate an unbounded list of per-flow transactions. Consequently, this leads to increasing CPU and memory...

CVE-2026-71418

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Its DNS-over-HTTP/2 processing incorrectly retains previously processed HTTP/2 DATA frame contents. A remote attacker can exploit this by sending multiple craft...

CVE-2026-67549

A flaw was found in OpenImageIO. A remote attacker could exploit this vulnerability by tricking a user into processing a specially crafted 1-bit CMYK TIFF image. The tiffinput::bitconvert function incorrectly writes 8-bit output into a smaller buffer allocated for 1-bit data, causing a heap...

CVE-2026-63446

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. Due to an inverted guard in the AppLayerParserSetTransactionInspectId function, transactions on flows passed by a pass rule or exception policy are not...

qt: Qt: Denial of Service via out-of-bounds read in text codec handling

A flaw was found in Qt, a popular software development framework. This vulnerability, an out-of-bounds read, occurs in the QTextCodec::codecForName function when it processes specially crafted input that is not properly terminated. An attacker could exploit this to cause the application to select...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...

CVE-2026-93313

A flaw was found in Poppler. This vulnerability, an integer overflow, occurs within the JBIG2Stream::readCodeTableSeg function when processing specially crafted JBIG2 image data. A remote attacker could exploit this by providing specially crafted input, which may lead to memory corruption. This...

CVE-2026-93312

A flaw was found in Freedesktop Poppler. A remote attacker could exploit a null pointer dereference vulnerability in the JBIG2Stream::rewind function. This could lead to a denial of service DoS, making the application unavailable to legitimate users. Mitigation Since Poppler is a library used by...

SUSE-SU-2026:4293-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276722. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...

SUSE-SU-2026:4292-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276722. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...

CVE-2026-63273

A flaw was found in LibreOffice Draw. This vulnerability allows a remote attacker to cause a denial of service by crafting a specially designed encrypted PDF document. When a user opens this malicious document, a heap buffer overflow occurs because the software incorrectly handles the decryption...