Security update for postgresql16

This update for postgresql16 fixes the following issues: Update to version 16.13 bsc1258754. Security issues fixed: CVE-2026-2003: improper validation of type "oidvector" may allow disclose a few bytes of server memory bsc1258008. CVE-2026-2004: intarray missing validation of type of input to...

SUSE-SU-2026:0882-1 Security update for postgresql16

This update for postgresql16 fixes the following issues: Update to version 16.13 bsc1258754. Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory bsc1258008. - CVE-2026-2004: intarray missing validation of type of input to...

SUSE-SU-2026:0881-1 Security update for postgresql18

This update for postgresql18 fixes the following issues: Update to version 18.3 bsc1258754. Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory bsc1258008. - CVE-2026-2004: intarray missing validation of type of input to...

vlc:vlc-demux-dec-libfuzzer-mp4: Heap-buffer-overflow in dav1d_prepare_intra_edges_8bpc

Detailed Report: https://oss-fuzz.com/testcase?key=4508621294862336 Project: vlc Fuzzing Engine: afl Fuzz Target: vlc-demux-dec-libfuzzer-mp4 Job Type: aflasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x7daa01f24780 Crash State: dav1dprepareintraedges8bpc...

Ubuntu: Security Advisory (USN-8018-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP13 : libpng (EulerOS-SA-2026-1283)

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From 1.6....

GHSA-RCHV-X836-W7XP OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage

OpenClaw's macOS Dashboard flow exposed Gateway authentication material to browser-controlled surfaces. Before the fix, the macOS app appended the shared Gateway token and password to the Dashboard URL query string when opening the Control UI in the browser. The Control UI then imported the token...

USN-7968-2 apache2 regression

USN-7968-1 fixed vulnerabilities in Apache HTTP Server. The update introduced a regression in modmd where the MDStapleOthers setting was ignored which resulted in OCSP being broken for some domains. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It w...

USN-7968-2: Apache HTTP Server regression

USN-7968-1 fixed vulnerabilities in Apache HTTP Server. The update introduced a regression in modmd where the MDStapleOthers setting was ignored which resulted in OCSP being broken for some domains. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It w...

USN-8018-2: Python regression

USN-8018-1 fixed vulnerabilities in python3. That update introduced regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused behavior regressions in IMAP and POP3 handling, which upstream chose to avoid by not backporting them. Additionally, the patch for CVE-2026-0865 incorrectly...

rdkit:smiles_string_to_mol_fuzzer: Bad-cast to RDKit::Atom from invalid vptr in RDKit::Canon::initCanonAtoms

Project: https://github.com/rdkit/rdkit.git Detailed Report: https://oss-fuzz.com/testcase?key=6396301163167744 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: smilesstringtomolfuzzer Job Type: libfuzzerubsanrdkit Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5c2e9f3266d0 Crash...

freetype2:truetype-render-i35: Stack-buffer-overflow in Conic_To

Detailed Report: https://oss-fuzz.com/testcase?key=4797788289564672 Project: freetype2 Fuzzing Engine: honggfuzz Fuzz Target: truetype-render-i35 Job Type: honggfuzzasanfreetype2 Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 8 Crash Address: 0x7a48199d0440 Crash State: ConicTo...

GHSA-7R4P-VJF4-GXV4 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

Summary Caddy's forwardauth directive with copyheaders generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name...

Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

Summary Caddy's forwardauth directive with copyheaders generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name...

SUSE SLES15 Security Update : postgresql14 (SUSE-SU-2026:0768-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0768-1 advisory. Update to version 14.22 bsc1258754. Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' may allow...

PT-2026-23796

Name of the Vulnerable Software and Affected Versions Caddy versions 2.10.0 through 2.11.1 Description Caddy is a server platform that utilizes TLS by default. A flaw exists in the forward auth functionality where the copy headers option fails to remove headers provided by the client. This can le...

cups:fuzz_cups: Heap-buffer-overflow in _cupsRasterAddError

Project: https://github.com/OpenPrinting/cups.git Detailed Report: https://oss-fuzz.com/testcase?key=4517534425743360 Project: cups Fuzzing Engine: libFuzzer Fuzz Target: fuzzcups Job Type: libfuzzerasancups Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 3 Crash Address: 0x7a86bd3e04a2...

SUSE SLES15: postgresql15 / postgresql15-contrib / postgresql15-devel / etc (SUSE-SU-2026:0771-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0771-1 advisory. Update to version 15.17 bsc1258754. Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' m...

SUSE: Security Advisory (SUSE-SU-2026:0769-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2026:0787-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...