SUSE-SU-2026:22655-1 Security update for python-mistune

This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py can lead to DoS bsc1271117. - CVE-2026-59923: HTMLRenderer.safeurl does not block percent-encoded javascript URIs and allows for XSS bsc1271119. -...

PT-2026-59615

Vulnerability Details CWE-918: Server-Side Request Forgery SSRF The parse urls API function in src/pyload/core/api/ init .py line 556 fetches arbitrary URLs server-side via get urlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permissi...

[SECURITY] Fedora 44 Update: python-dulwich-1.2.9-1.fc44

Dulwich is a Python implementation of the Git file formats and protocols. The project is named after the village in which Mr. and Mrs. Git live in the Monty Python sketch...

DEBIAN-CVE-2026-57216

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend...

ho-protocols (>=0.0.1, <=0.0.2.dev4), robotframework-browser (>=3.3.0, <=4.0.0) +1 more potentially affected by CVE-2026-0994 via protobuf (3.15.5)

protobuf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ho-protocols =0.0.1, =3.3.0, =4.0.0 - sankee 0.0.1 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

ho-protocols (>=0.0.1, <=0.0.2.dev4), robotframework-browser (>=3.3.0, <=4.0.0) +1 more potentially affected by CVE-2025-4565 via protobuf (3.15.5)

protobuf PYPI version 3.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - ho-protocols =0.0.1, =3.3.0, =4.0.0 - sankee 0.0.1 Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...

MySQL Connector/Python connector takeover vulnerability

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors...

[SECURITY] Fedora 43 Update: rust-wayland-scanner-0.31.10-3.fc43

Wayland Scanner for generating rust APIs from XML wayland protocol files...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

CVE-2026-13491: Improper Resource Shutdown or Release

A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqttprotocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument sessionid results in denial of service. The...

CVE-2026-5409

A flaw was found in Wireshark. A remote attacker could exploit a vulnerability in the Monero protocol dissector, leading to a crash of the application. This could result in a denial of service DoS for users analyzing network traffic. Mitigation To mitigate this issue, users can disable the Monero...

[SECURITY] Fedora 44 Update: nginx-1.30.3-1.fc44

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

[SECURITY] Fedora 43 Update: nginx-1.30.3-1.fc43

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

GHSA-F9VR-G2G2-X9FG Hackney has CRLF / header injection in WebSocket upgrade request

Summary CRLF injection in hackney's WebSocket upgrade request builder src/hackneyws.erl. init/1 copies the host, path, headers, and protocols options from the caller-supplied opts map verbatim into wsdata, and dohandshake/1 splices them directly into the raw HTTP/1.1 upgrade request by binary...

CVE-2026-56766

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an...

EUVD-2026-39515

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an...

CVE-2026-56766 Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an...

CVE-2026-56766 Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an...

MySQL PostgreSQL ProxySQL Memory Corruption

The vulnerability of the MySQL and PostgreSQL proxy-server protocol implementations relates to the execution of operations outside the memory buffer. Exploiting this vulnerability can allow a malicious actor to induce memory corruption...

[SECURITY] Fedora 44 Update: coturn-4.13.1-1.fc44

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gatew ay. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying...