CLEANSTART-2026-JS27352 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

OPENSUSE-SU-2026:10574-1 jetty-annotations-9.4.58-4.1 on GA media

These are all security issues fixed in the jetty-annotations-9.4.58-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10578-1 tempo-cli-2.10.4-1.1 on GA media

These are all security issues fixed in the tempo-cli-2.10.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10570-1 aardvark-dns-1.17.1-1.1 on GA media

These are all security issues fixed in the aardvark-dns-1.17.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10575-1 python311-Pillow-12.2.0-2.1 on GA media

These are all security issues fixed in the python311-Pillow-12.2.0-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10572-1 chromedriver-147.0.7727.101-1.1 on GA media

These are all security issues fixed in the chromedriver-147.0.7727.101-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10573-1 cpp-httplib-devel-0.42.0-1.1 on GA media

These are all security issues fixed in the cpp-httplib-devel-0.42.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10576-1 python311-jwcrypto-1.5.7-2.1 on GA media

These are all security issues fixed in the python311-jwcrypto-1.5.7-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10577-1 skopeo-1.22.1-1.1 on GA media

These are all security issues fixed in the skopeo-1.22.1-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-574F-3G2M-X479 Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

The GOST 28147-2015 CTR mode implementation G3413CTRBlockCipher in the Legion of the Bouncy Castle BC-JAVA bcprov core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe...

EUVD-2026-23421

PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...

JLSEC-2026-141

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in vector totalsizes for attacker-controlled large counts across many parts,...

CVE-2026-40459

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10...

CVE-2026-40459

CVE-2026-40459 concerns the PAC4J library, which is vulnerable to LDAP Injection in multiple methods. A low-privileged, remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially causing unauthorized LDAP queries and arbitrary directory operations. The vulnerabili...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: postgresql18: postgresql-18.3-1.2.hum1 aarch64, x8664 postgresql-contrib-18.3-1.2.hum1 aarch64, x8664 postgresql-docs-18.3-1.2.hum1 aarch64, x8664 postgresql-plperl-18.3-1.2.hum1 aarch64, x8664...

ROOT-OS-DEBIAN-13-CVE-2025-6075 CVE-2025-6075 in rootio-python3.13 - Patched by Root

Root has patched CVE-2025-6075 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...

USN-8177-1: Linux kernel vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcod...

SUSE-SU-2026:21210-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: Update to google-cloud-sap-agent 3.12 bsc1259816: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header bsc1260265. Changes for google-cloud-sap-agent: Collect...

Security Bulletin: Due to use of jackrabbit-spi-commons IBM webMethods BPM is vulnerable to loading privileges using unsecured document build

Summary IBM webMethods BPM is using jackrabbit-spi-commons which is affected by a known vulnerability CVE-2025-53689. This security bulletin provides guidance on addressing the vulnerability. Vulnerability Details CVEID:CVE-2025-58782 DESCRIPTION: Deserialization of Untrusted Data vulnerability i...

CLEANSTART-2026-KF53276 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...