OPENSUSE-SU-2026:11494-1 clusterctl-1.14.0-1.1 on GA media

These are all security issues fixed in the clusterctl-1.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

Security update for go-sendxmpp (important)

openSUSE Security Update: Security update for go-sendxmpp Announcement ID: openSUSE-SU-2026:0280-1 Rating: important References: 1266617 Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE: 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products: openSU...

PT-2026-114468

Уязвимость демона dockerd библиотеки go-archive интерфейса командной строки платформы для разработки и доставки контейнерных приложений Docker Desktop и инструмента для управления многоконтейнерными приложениями Docker Compose связана с некорректным определением символических ссылок перед доступо...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Cloud installation tool (cloudkit) are now fixed in 5.2.3.8 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the cloud deployment installation tool cloudkit could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.8 or higher and 6.0.1.1. Vulnerability Details CVEID:CVE-2026-29181 DESCRIPTION:...

BloodHound v9.6.0-rc2

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

CVE-2026-19496

A flaw was found in sources-api-go. An authenticated remote user can exploit a SQL injection vulnerability by injecting arbitrary SQL expressions through query parameter filtering. This can lead to unauthorized information disclosure of internal database fields, arbitrary PostgreSQL function...

SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv...

SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv...

DEBIAN-CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

UBUNTU-CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

Security update for suseconnect-ng

This update for suseconnect-ng fixes the following issue: Update version to 1.23.0: Use product identifier for product migrations. bsc1268596 Switch to using go1.26-openssl as the default Go version to install to support building the package jscSCC-843, bsc1268900. Fix flag parsing so that unknow...

CVE-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

CVE-2026-72582 fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

Security Bulletin:Vulnerability in Go JOSE affects IBM Netezza Appliance

Summary The Go JOSE package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-34986 Vulnerability Details CVEID:CVE-2026-34986 DESCRIPTION: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go,...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Photon OS 5.0: Go PHSA-2026-5.0-90-0763

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Go PHSA-2023-5.0-91-0037

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0037. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...