PT-2026-89711

These are all security issues fixed in the expat-2.8.4-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-89144

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media tools/dvb mpe.c, descriptorTime slice fec identifier and gf m2ts ipdatagram reader components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938...

OPENSUSE-SU-2026:11737-1 sshamble-0.3.12-1.1 on GA media

These are all security issues fixed in the sshamble-0.3.12-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-88773

Tanium addressed a path traversal vulnerability in Comply...

python-urllib3 security update

1.10.2-7.0.3 - Backport fix for CVE-2025-66471 Orabug: 39233228...

PT-2026-89712

These are all security issues fixed in the perl-Authen-SASL-2.210.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11734-1 perl-Authen-SASL-2.210.0-1.1 on GA media

These are all security issues fixed in the perl-Authen-SASL-2.210.0-1.1 package on the GA media of openSUSE Tumbleweed...

Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: Incomplete fix for...

libopenslide-devel-4.0.1-1.1 on GA media (moderate)

libopenslide-devel-4.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11707-1 Rating: moderate Cross-References: CVE-2026-48977 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

CVE-2026-85505 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85505 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-70409 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-70409 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20

CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...

CVE-2026-85509 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85509 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

GHSA-JXFW-X594-9X9M morgan vulnerable to Log Forging via unescaped Unicode line separators

Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, or U+2029 PARAGRAPH SEPARATOR. These code points...

morgan vulnerable to Log Forging via unescaped Unicode line separators

Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, or U+2029 PARAGRAPH SEPARATOR. These code points...

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Details Static site generation builds each output path from the route pat...

NPM: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

NPM: Hono: Incomplete fix for CVE-2026-39408: toSSG still writes files outside the output directory vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...

GHSA-GQVV-2MRQ-WPJV Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Details Static site generation builds each output path from the route pat...

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Summary TagReference.create forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read the file's contents are returned in-band as the annotated tag message. This is an incomplete-fix bypass of...