OPENSUSE-SU-2026:22069-1 Security update for pacemaker

This update for pacemaker fixes the following issues: Security issue fixed: - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381. Changes for pacemaker: Update to version 3.0.3+20260728.7052efa194: - cts: make cts-scheduler -o/--out-dir default to a...

SUSE-SU-2026:24251-1 Security update for pacemaker

This update for pacemaker fixes the following issues: Security issue fixed: - CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381. Changes for pacemaker: Update to version 3.0.3+20260728.7052efa194: - cts: make cts-scheduler -o/--out-dir default to a...

CVE-2026-104635

A flaw was found in protobuf. An unauthenticated remote attacker can trigger a Denial of Service DoS by submitting a deeply nested JSON document to an application configured to decode self-referential message types. Because the decoder fails to enforce recursion limits on these structures,...

SUSE-SU-2026:24132-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issue: - CVE-2026-78807: Security bypass via missing PMKSA validation bsc1280914. - Fix incomplete RADIUS Message-Authenticator attribute validation in hostapd...

CVE-2026-107908 Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message

A heap-based out-of-bounds write in the BoltReadHandler function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt...

CVE-2026-107908

FalkorDB versions prior to 4.20.0 are vulnerable to a heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c). The flaw occurs because the handler uses ASSERT() to validate the chunk size, which is omitted in release builds. This allows a remote unauthenticated attack...

EUVD-2026-95311

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

EUVD-2026-95305

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

EUVD-2026-95352

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...

EUVD-2026-95349

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

Cisco Application Policy Infrastructure Controller Message Data Compromise

The vulnerability of the Cisco Application Policy Infrastructure Controller APIC management tool is related to insufficient assurance of the correctness of messages or data structures. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

SUSE SLES15 Security Update : wpa_supplicant (SUSE-SU-2026:4587-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4587-1 advisory. This update for wpasupplicant fixes the following issue: - CVE-2026-78807: missing validation in driver-based PMKSA selection within...

SUSE CVE-2026-93034

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

CVE-2026-107799

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

CVE-2026-107792

Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any...

CVE-2026-107797

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview banks is an A prompt programming language Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via Prompt.chatmessages, which parsed every line of a rendered template as a possible ChatMessage...

CVE-2026-107831 Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

CVE-2026-107831

The software Jivejdon (through version 5.0 ) is vulnerable to a cross-site request forgery (CSRF) vulnerability. The root cause is the presence of GET endpoints that lack anti-CSRF tokens, allowing remote attackers to perform state-changing actions. By luring authenticated users into clicking cra...

CVE-2026-107831 Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...