openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:22145-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22145-1 advisory. - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers bsc1279042. -...

PT-2026-121755

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who...

Linux Distros Unpatched Vulnerability : CVE-2026-115221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or...

AZL-111020 CVE-2026-115449 affecting package libslirp 4.9.3-1

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

DEBIAN-CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

sitrep

SitRep Extensible, configurable host triage. Purpose SitRep is intended to provide a lightweight, extensible host triage alternative. Checks are loaded dynamically at runtime from stand-alone files. This allows operators to quickly modify existing checks, or add new checks as required. Checks are...

CVE-2026-115449 Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

CVE-2026-115449 Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

CVE-2026-115449

A flaw exists in libslirp where the reply length is not updated to match the actual data received from the host during ICMP echo request handling. When the normal ICMP socket is unavailable, this length desynchronization causes the host's real IP address to be leaked to the guest, compromising th...

CVE-2026-114625

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

CVE-2026-114732

A flaw was found in Roundcube Webmail. In multi-host installations, user authentication using an alias address does not restrict account lookup to the specific Internet Message Access Protocol IMAP host. A remote authenticated user could exploit this flaw to gain unauthorized access to another...

CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

CVE-2026-115221

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

CVE-2026-79609

A flaw was found in Xen. A malicious paravirtualized PV guest can cause a denial of service DoS by crashing the host hypervisor. During Xen Page Table Isolation XPTI processing, Xen attempts to access guest root page tables located in memory beyond the direct memory mapping boundary. Attempting t...

CVE-2026-115424 Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...

CVE-2026-115424

A flaw in the OpenShift client (oc) allows for a symlink/hardlink target validation bypass during the oc image extract operation. The application fails to properly sanitize links pointing to absolute paths or sibling directories, enabling an attacker providing a malicious container image to write...

CVE-2026-115424

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a...