SUSE-SU-2026:1159-1 Security update for expat

This update for expat fixes the following issues: - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value bsc1259726. - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing bsc1259711. - CVE-2026-3277...

CVE-2026-32920

creationtimestamp| type| source ---|---|--- 2026-03-31 12:51:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mie7pzf3zw2h 2026-03-31 13:19:01+00:00| seen| Telegram/jSTFa01DEWFRhQKHtf4fP3tqxxyDE1Jfuh4yALHVDvczs38 2026-03-31 13:51:47+00:00| seen|...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: syft, guac, gitea, amazon-ssm-agent-fips, kyverno, packer, argo-events-fips, xeol, kubevela, kyverno-fips, kaniko-fips, livekit-cli, grafana-alloy-fips, grafana-fips, src-fingerprint-fips, external-secrets-operator, gitaly, flux-source-controller-fips, src-fingerprin...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: syft, guac, gitea, amazon-ssm-agent-fips, kyverno, packer, argo-events-fips, xeol, kubevela, kyverno-fips, kaniko-fips, livekit-cli, grafana-alloy-fips, grafana-fips, src-fingerprint-fips, external-secrets-operator, gitaly, flux-source-controller-fips, src-fingerprin...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: syft, guac, gitea, amazon-ssm-agent-fips, kyverno, packer, argo-events-fips, xeol, kubevela, kyverno-fips, kaniko-fips, livekit-cli, grafana-alloy-fips, grafana-fips, src-fingerprint-fips, external-secrets-operator, gitaly, flux-source-controller-fips, src-fingerprin...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: flux, tfsec, osv-scanner, wolfictl, gitsign, gitaly, gitea, zarf, gomplate, argo-cd, pulumi-language-yaml, kyverno, snyk-cli, argocd-image-updater, melange, witness, cerbos, nfpm, pulumi, pulumi-language-dotnet, crossplane, apko, kubescape, src-fingerprint, zot,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: flux, tfsec, osv-scanner, wolfictl, gitsign, gitaly, gitea, zarf, gomplate, argo-cd, pulumi-language-yaml, kyverno, snyk-cli, argocd-image-updater, melange, witness, cerbos, nfpm, pulumi, pulumi-language-dotnet, crossplane, apko, kubescape, src-fingerprint, zot,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: flux, tfsec, osv-scanner, wolfictl, gitsign, gitaly, gitea, zarf, gomplate, argo-cd, pulumi-language-yaml, kyverno, snyk-cli, argocd-image-updater, melange, witness, cerbos, nfpm, pulumi, pulumi-language-dotnet, crossplane, apko, kubescape, src-fingerprint, zot,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: flux, tfsec, osv-scanner, wolfictl, gitsign, gitaly, gitea, zarf, gomplate, argo-cd, pulumi-language-yaml, kyverno, snyk-cli, argocd-image-updater, melange, witness, cerbos, nfpm, pulumi, pulumi-language-dotnet, crossplane, apko, kubescape, src-fingerprint, zot,...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

PT-2026-29422

Name of the Vulnerable Software and Affected Versions ONNX versions prior to 1.21.0 Description ONNX contains a path traversal vulnerability via symlink that allows reading arbitrary files outside the model or user-provided directory. The vulnerability exists because the check for symlinks is...

PT-2026-29374

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version http://localhost:8080/system/status allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External...

PT-2026-29357

Name of the Vulnerable Software and Affected Versions XML Notepad versions prior to 2.9.0.21 Description XML Notepad, a Windows program for editing XML documents, does not disable DTD processing by default before version 2.9.0.21. This allows for the resolution of external entities. An attacker c...

FreeScout 安全漏洞

FreeScout is a lightweight and powerful free open-source help desk and shared inbox built using PHP Laravel framework by FreeScout Inc. Versions of FreeScout prior to 1.8.211 contained security vulnerabilities, which were due to unvalidated host header operations, potentially leading to external...

EUVD-2026-17148

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

XML External Entity (XXE) Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the SVG file upload functionality in the admin panel and File Manager plugin. An attacker can access...

SUSE-SU-2026:20985-1 Security update for expat

This update for expat fixes the following issues: - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value bsc1259726. - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing bsc1259711. - CVE-2026-3277...

OPENSUSE-SU-2026:20448-1 Security update for expat

This update for expat fixes the following issues: - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value bsc1259726. - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing bsc1259711. - CVE-2026-3277...

[SECURITY] [DLA 4515-1] asterisk security update

Debian LTS Advisory DLA-4515-1 [email protected] https://www.debian.org/lts/security/ Lukas Märdian March 29, 2026 https://wiki.debian.org/LTS Package : asterisk Version : 1:16.28.0dfsg-0+deb11u9 CVE ID : CVE-2026-23738 CVE-2026-23739 CVE-2026-23740 CVE-2026-23741 Debian Bug : 1127438...