OPENSUSE-SU-2026:11303-1 wget-1.25.0-4.1 on GA media

These are all security issues fixed in the wget-1.25.0-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11291-1 helm-4.2.3-2.1 on GA media

These are all security issues fixed in the helm-4.2.3-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11298-1 perl-DBI-1.651.0-1.1 on GA media

These are all security issues fixed in the perl-DBI-1.651.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:21363-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 150.0.7871.124 boo1271415: CVE-2026-15764: Use after free in Ozone CVE-2026-15765: Use after free in Ozone CVE-2026-15766: Uninitialized Use in Skia CVE-2026-15767: Heap buffer overflow in libyuv CVE-2026-15768:...

CVE-2026-63304

creationtimestamp| type| source ---|---|--- 2026-07-16 13:42:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrehkrzjo2w 2026-07-16 15:10:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrjg32vln2m...

CVE-2023-49900

creationtimestamp| type| source ---|---|--- 2026-07-16 10:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqqztryhh52d 2026-07-16 10:47:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqr2p73vnu2i...

CVE-2026-12684

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...

CVE-2026-12684

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...

CVE-2026-12684

CVE-2026-12684 affects the Customer Reviews for WooCommerce WordPress plugin prior to version 5.113.0. The issue is an unauthenticated media upload via a media upload AJAX action when the review media attachment feature is enabled. The vulnerability arises from missing authentication, capability,...

CVE-2026-12684 Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...

EUVD-2026-44877

The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files bounded to an image a...

perl-Mojolicious-9.480.0-1.1 on GA media (moderate)

perl-Mojolicious-9.480.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11282-1 Rating: moderate Cross-References: CVE-2026-15747 CVSS scores: CVE-2026-15747 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N CVE-2026-15747 SUSE : 5.9...

gpsd-3.27.5-3.1 on GA media (moderate)

gpsd-3.27.5-3.1 on GA media Announcement ID: openSUSE-SU-2026:11276-1 Rating: moderate Cross-References: CVE-2026-58459 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the gpsd-3.27.5-3.1...

OPENSUSE-SU-2026:11287-1 chromedriver-150.0.7871.124-1.1 on GA media

These are all security issues fixed in the chromedriver-150.0.7871.124-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-55445

creationtimestamp| type| source ---|---|--- 2026-07-15 23:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqptj5juer2c 2026-07-16 00:38:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpyoz5fpx22 2026-07-16 01:30:26+00:00| seen|...

GHSA-Q78P-HJ9H-5466 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

SUSE CVE-2026-15771

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-45806

Penpot before 2.15.0 vulnerable to authenticated SSRF in remote image import. The flow passes a user-controlled URL from frontend to the backend RPC method create-file-media-object-from-url, where media/download-image uses a shared HTTP client without destination filtering, allowing an authentica...

CVE-2026-45806 Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in...