SUSE-SU-2026:22830-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service bsc1271465. -...

SUSE-SU-2026:22765-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service bsc1271465. -...

CVE-2026-64621 FreeRDP before 3.28.0 Double-Free via selectedmonitors

FreeRDP before 3.28.0 affected 3.x through 3.27.1 contains a double-free vulnerability in freerdpclientrdpfileapplytosettings client/common/file.c when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning...

CVE-2026-13577

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

The Dancer2 web framework for Perl (versions before 2.2.0 ) is vulnerable to the generation of insecure session IDs when required CSPRNG modules, specifically Math::Random::ISAAC::XS and Crypt::URandom , are unavailable. The component Dancer2::Core::Role::SessionFactory::generate_id silently fall...

CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

PT-2026-61573

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and...

CVE-2026-13577: Generation of Predictable Numbers or Identifiers

Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

Linux Distros Unpatched Vulnerability : CVE-2026-63881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit siz...

Linux Distros Unpatched Vulnerability : CVE-2026-13577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate...

CVE-2026-63881

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

CVE-2026-9323

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-62219

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the allowedAgentIds validation. An attacker can gain unauthorized access to restricted actions by submitting blank agent IDs, thereby bypassing intended...

CVE-2026-62219

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or...

CVE-2026-62219

OpenClaw 2026.2.12 before 2026.5.26 contains an authorization bypass in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can submit blank agent IDs to bypass agent ID restrictions, enabling actions that should require stronger authorization or policy checks. Aff...

CVE-2026-62219: Incorrect Authorization

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or...