OPENSUSE-SU-2026:11443-1 amazon-ecs-init-1.106.0-1.1 on GA media

These are all security issues fixed in the amazon-ecs-init-1.106.0-1.1 package on the GA media of openSUSE Tumbleweed...

chromedriver-151.0.7922.71-1.1 on GA media (moderate)

chromedriver-151.0.7922.71-1.1 on GA media Announcement ID: openSUSE-SU-2026:11434-1 Rating: moderate Cross-References: CVE-2026-17650 CVE-2026-17651 CVE-2026-17652 CVE-2026-17653 CVE-2026-17654 CVE-2026-17655 CVE-2026-17656 CVE-2026-17657 CVE-2026-17658 CVE-2026-17659 CVE-2026-17660 CVE-2026-176...

CVE-2026-69089 Grav CMS before 2.0.11 Path Traversal via watermark

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

CVE-2026-69089

Grav CMS 2.0.10 is affected by a path traversal vulnerability in ImageMedium::watermark() that passes the unsanitized image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). The file:// path handling only collapses '..' lexically, enabling an editor composing...

firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: GMP component...

OPENSUSE-SU-2026:11439-1 corepack24-24.18.1-1.1 on GA media

These are all security issues fixed in the corepack24-24.18.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11438-1 alloy-1.18.0-1.1 on GA media

These are all security issues fixed in the alloy-1.18.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-16285

The CVE-2026-16285 affects the WooCommerce Product Attachment WordPress plugin (prior to version 2.3.3). The root cause is a missing authorization check when streaming media library files, enabling unauthenticated users to download any attachment by enumerating its numeric ID. Impact is stated as...

CVE-2026-16285 WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID...

CVE-2026-15248

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

CVE-2026-15248

Affected software: Meta Box WordPress plugin (WordPress) prior to 5.13.1. Vulnerability: does not verify that the user is authorized to delete the supplied attachment, enabling a low-privilege user (e.g., Contributor) to permanently delete arbitrary media attachments owned by other users. Root ca...

EUVD-2026-51935

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

python313-asteval-1.0.9-1.1 on GA media (moderate)

python313-asteval-1.0.9-1.1 on GA media Announcement ID: openSUSE-SU-2026:11420-1 Rating: moderate Cross-References: CVE-2026-55244 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media (moderate)

gdk-pixbuf-loader-libheif-1.23.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11416-1 Rating: moderate Cross-References: CVE-2026-62289 CVE-2026-62291 CVE-2026-62292 CVE-2026-62377 Affected Products: openSUSE Tumbleweed An update that solves 4 vulnerabilities can now be installed. Descriptio...

libntpc1-1.2.5-1.1 on GA media (moderate)

libntpc1-1.2.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11417-1 Rating: moderate Cross-References: CVE-2026-18321 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the libntpc1-1.2.5-1....

OPENSUSE-SU-2026:11435-1 gd-2.3.3-5.1 on GA media

These are all security issues fixed in the gd-2.3.3-5.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11436-1 golang-github-prometheus-prometheus-3.13.2-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-13596

creationtimestamp| type| source ---|---|--- 2026-08-01 14:51:36+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrzpslqvwa22 2026-08-01 14:51:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzpslxgmm2x 2026-08-01 14:51:38+00:00| seen|...

CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

CVE-2026-67290 FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...