Unbreakable Enterprise kernel security update

5.4.17-2136.356.4.2 - arm64: errata: Mitigate TLBI errata on various Arm CPUs Mark Rutland Orabug: 39017592 CVE-2025-10263 - arm64: tlb: Add ARM64WORKAROUNDREPEATTLBISYNC Mark Rutland Orabug: 39017592 - ARM: uek: Disable CONFIGQCOMFALKORERRATUM1003 Boris Ostrovsky Orabug: 39017592 - arm64: tlb:...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to insecure handling of TLS connections when communicating with vCenter. An attacker can intercept and obtain administrator credentials by performing a man-in-the-middle attack. Remediation A fix was...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to insecure handling of TLS connections when communicating with vCenter. An attacker can intercept and obtain administrator credentials by performing a man-in-the-middle attack. Remediation A fix was...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to insecure handling of TLS connections when communicating with vCenter. An attacker can intercept and obtain administrator credentials by performing a man-in-the-middle attack. Remediation A fix was...

amazon-ssm-agent-3.3.4624.0-1.1 on GA media (moderate)

amazon-ssm-agent-3.3.4624.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10943-1 Rating: moderate Cross-References: CVE-2026-44740 CVSS scores: CVE-2026-44740 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-44740 SUSE : 8.7...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to insecure handling of TLS connections when communicating with vCenter. An attacker can intercept and obtain administrator credentials by performing a man-in-the-middle attack. Remediation A fix was...

PT-2026-47175

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN 0042e200 of the file /cgi-bin/glc of the component SET USER PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version...

erlang27-27.1.3-2.1 on GA media (moderate)

erlang27-27.1.3-2.1 on GA media Announcement ID: openSUSE-SU-2026:10947-1 Rating: moderate Cross-References: CVE-2025-4748 CVE-2025-48038 CVE-2025-48039 CVE-2026-21620 CVE-2026-23941 CVE-2026-23942 CVE-2026-23943 CVE-2026-28808 CVE-2026-28810 CVE-2026-32144 CVE-2026-32147 CVE-2026-42789...

CVE-2026-45570

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containin...

SUSE CVE-2022-50077

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix reference count leak in aapivotroot The aapivotroot function has a reference counting bug in a specific path. When aareplacecurrentlabel returns on success, the function forgets to decrement the reference count of...

SUSE CVE-2026-41567

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon resolves decompression binaries such as xz or unpigz fr...

CVE-2026-20245

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplyi...

EUVD-2026-34918

A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authenticated user with basic git access to...

RHEL 9 : kernel (RHSA-2026:23237)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:23237 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: use dstdevrcu in...

libopenbabel8-3.2.0-1.1 on GA media (moderate)

libopenbabel8-3.2.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10936-1 Rating: moderate Cross-References: CVE-2022-37331 CVE-2022-43467 CVE-2022-46280 CVE-2022-46291 CVE-2022-46295 CVE-2025-10996 CVE-2025-10999 CVE-2026-2705 CVSS scores: CVE-2025-10996 SUSE : 5.3...

EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-2171)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nvme: nvme-fc: Ensure -ioerrwork is cancelled in nvmefcdeletectrlCVE-2025-40261 cifs: fix session state check in reconnect to avoid...

RHEL 10 : ovn25.03 (RHSA-2026:22110)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22110 advisory. OVN, the Open Virtual Network, is a system to support virtual network abstraction. OVN complements the existing capabilities of OVS to add...

RHEL 8 : kernel (RHSA-2026:22964)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22964 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: nvme: avoid double free speci...

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Description Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName straight into its HTML output without escaping: php protected function formatTemplateProfile $profile, $prefix: string return \sprintf'%s└ %s', $prefix, self::$colors'template', $profile-getTemplate; The...

GHSA-2G2G-8P8H-FGWM Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Description Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName straight into its HTML output without escaping: php protected function formatTemplateProfile $profile, $prefix: string return \sprintf'%s└ %s', $prefix, self::$colors'template', $profile-getTemplate; The...